Windows Analysis Report
wE1inOhJA5.msi

AI detected suspicious sample

Source: Yara match	File source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4490232230.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: task.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: task.exe PID: 1272, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: C:\Users\user\task.exe	Code function: 22_2_00091181 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	22_2_00091181
Source: C:\Users\user\task.exe	Code function: 22_2_00066AFD CryptUnprotectData,LoadLibraryA,GetProcAddress,	22_2_00066AFD
Source: C:\Users\user\task.exe	Code function: 24_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,	24_2_00404423

Source: task.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: unknown

HTTPS traffic detected: 179.43.171.196:443 -> 192.168.2.9:49740 version: TLS 1.2

Source:	Binary string: your_package_name.pdbG source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1573600735.000000006C906000.00000002.00000001.01000000.00000006.sdmp, task.exe, 00000008.00000003.1472143930.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000016.00000002.4498290278.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp, task.exe, 0000001E.00000002.4491311882.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: wkernel32.pdb source: task.exe, 00000019.00000003.1667788844.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1667935272.0000000002C70000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676696250.0000000005550000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676535563.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1572618363.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: task.exe, 00000019.00000003.1664725236.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1665323555.0000000002D40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675135210.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675381954.0000000005620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: your_package_name.pdbI source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: task.exe, 00000019.00000003.1665989629.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1666587570.0000000002CF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675802717.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676138788.00000000055D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: task.exe, 00000019.00000003.1664725236.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1665323555.0000000002D40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675135210.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675381954.0000000005620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: task.exe, 00000019.00000003.1665989629.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1666587570.0000000002CF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675802717.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676138788.00000000055D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\<.oeaccount source: task.exe, 0000001A.00000002.1666589979.000000000061C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: your_package_name.pdb source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1573600735.000000006C906000.00000002.00000001.01000000.00000006.sdmp, task.exe, 00000008.00000003.1472143930.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000016.00000002.4498290278.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp, task.exe, 0000001E.00000002.4491311882.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: task.exe, 00000019.00000003.1667788844.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1667935272.0000000002C70000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676696250.0000000005550000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676535563.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: expand.exe, 00000006.00000003.1433042313.000000000482F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1572618363.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000008.00000002.1571419937.0000000000402000.00000002.00000001.01000000.00000005.sdmp, task.exe, 00000008.00000000.1439408986.0000000000402000.00000002.00000001.01000000.00000005.sdmp, task.exe, 00000016.00000000.1579511832.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000016.00000002.4486274195.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000018.00000000.1650674244.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000019.00000002.1675825905.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001A.00000000.1651000866.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001B.00000000.1652070836.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001E.00000002.4486356902.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001E.00000000.1662738715.0000000000402000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\. source: task.exe, 0000001A.00000002.1666589979.0000000000608000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8FB0E1 FindFirstFileExW,	8_2_6C8FB0E1
Source: C:\Users\user\task.exe	Code function: 22_2_6FE9B0E1 FindFirstFileExW,	22_2_6FE9B0E1
Source: C:\Users\user\task.exe	Code function: 22_2_0006BF45 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	22_2_0006BF45
Source: C:\Users\user\task.exe	Code function: 22_2_0006919E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	22_2_0006919E
Source: C:\Users\user\task.exe	Code function: 22_2_00068290 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	22_2_00068290
Source: C:\Users\user\task.exe	Code function: 22_2_000672F0 FindFirstFileW,FindNextFileW,	22_2_000672F0
Source: C:\Users\user\task.exe	Code function: 22_2_0007A467 FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,	22_2_0007A467
Source: C:\Users\user\task.exe	Code function: 22_2_0006B6E8 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	22_2_0006B6E8
Source: C:\Users\user\task.exe	Code function: 22_2_000A97E9 FindFirstFileExA,	22_2_000A97E9
Source: C:\Users\user\task.exe	Code function: 22_2_0006B903 FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	22_2_0006B903
Source: C:\Users\user\task.exe	Code function: 22_2_00068D46 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	22_2_00068D46
Source: C:\Users\user\task.exe	Code function: 22_2_00077DE7 FindFirstFileW,FindNextFileW,FindNextFileW,	22_2_00077DE7
Source: C:\Users\user\task.exe	Code function: 22_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	22_2_100010F1
Source: C:\Users\user\task.exe	Code function: 22_2_10006580 FindFirstFileExA,	22_2_10006580
Source: C:\Users\user\task.exe	Code function: 24_2_0040AE51 FindFirstFileW,FindNextFileW,	24_2_0040AE51

Source: C:\Users\user\task.exe

Code function: 22_2_0006771B SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

22_2_0006771B

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 25MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49713 -> 179.43.171.197:3393
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49715 -> 179.43.171.197:3393
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49714 -> 179.43.171.197:3393
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49716 -> 179.43.171.197:3393
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 179.43.171.196:5982 -> 192.168.2.9:49718
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 179.43.171.196:5982 -> 192.168.2.9:49733
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 179.43.171.196:5982 -> 192.168.2.9:49739
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 179.43.171.196:443 -> 192.168.2.9:49740

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 179.43.171.196 5982

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txna
Source: Malware configuration extractor	URLs: rm.anonbaba.net

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 179.43.171.196 ports 5982,2,443,5,8,9

Source: global traffic	TCP traffic: 192.168.2.9:49713 -> 179.43.171.197:3393
Source: global traffic	TCP traffic: 192.168.2.9:49718 -> 179.43.171.196:5982

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 129.6.15.28 129.6.15.28
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: PLI-ASCH PLI-ASCH

Source: Joe Sandbox View

JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49717 -> 178.237.33.50:80
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 179.43.171.196:5982 -> 192.168.2.9:49733
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 179.43.171.196:5982 -> 192.168.2.9:49739

Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.196

Source: C:\Users\user\task.exe

Code function: 22_2_00079664 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

22_2_00079664

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: task.exe, 00000018.00000003.1683160704.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: task.exe, 00000018.00000003.1683160704.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: task.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: task.exe, 00000016.00000002.4496169757.0000000002FF0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: task.exe, 00000016.00000002.4496169757.0000000002FF0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: rm.anonbaba.net
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: time-a-g.nist.gov
Source: global traffic	DNS traffic detected: DNS query: ts1.aco.net
Source: global traffic	DNS traffic detected: DNS query: ntp.nict.jp
Source: global traffic	DNS traffic detected: DNS query: ntp.time.in.ua
Source: global traffic	DNS traffic detected: DNS query: ntp1.net.berkeley.edu
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: svchost.exe, 00000020.00000003.1949101503.000001BE85629000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0
Source: svchost.exe, 00000020.00000003.1949101503.000001BE85629000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.01:
Source: task.exe, 00000016.00000003.1637474365.0000000003660000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647985043.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647419384.0000000000875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1645514022.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648455258.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp$
Source: task.exe, 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, task.exe, 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, task.exe, 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, task.exe, 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1686427068.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4490232230.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1685975988.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp6
Source: task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1686427068.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4490232230.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1685975988.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpN
Source: task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1645514022.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648455258.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1639168513.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647020161.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gphy
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1656628346.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: task.exe, 0000001B.00000002.1656628346.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.coma
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: task.exe, 00000018.00000002.1683843310.0000000000193000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: svchost.exe, 0000001F.00000002.1764768294.000000000330C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.1764466512.0000000000C7C000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.2169208927.000001BE856B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2171115892.000001BE8295E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txna
Source: svchost.exe, 0000001F.00000002.1764768294.000000000330C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnakernelbasentdllkernel32GetProcessMitigati
Source: svchost.exe, 00000020.00000002.2171115892.000001BE8295E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnas
Source: svchost.exe, 0000001F.00000002.1764466512.0000000000C7C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnax
Source: svchost.exe, 00000020.00000003.2169208927.000001BE856B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnaymb
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msedge.exe, 00000026.00000002.1935253683.00001C0003170000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: svchost.exe, 0000001F.00000003.1695689800.000000000339F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-query
Source: svchost.exe, 0000001F.00000003.1695689800.000000000339F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: task.exe, 00000018.00000003.1666212847.0000000002134000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1683160704.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1665557177.0000000002131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: task.exe, 00000018.00000003.1666212847.0000000002134000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1665557177.0000000002131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: task.exe, 00000018.00000003.1666212847.0000000002134000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1665557177.0000000002131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: task.exe, 00000018.00000002.1685293190.000000000212D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1683033412.000000000212C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1683064834.000000000212C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000018.00000003.1683263384.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_i__
Source: task.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: msedge.exe, 00000026.00000002.1935253683.00001C0003170000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: task.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 179.43.171.196:443 -> 192.168.2.9:49740 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\task.exe

Code function: 22_2_00069E55 SetWindowsHookExA 0000000D,00069E3E,00000000

22_2_00069E55

Source: C:\Users\user\task.exe

Code function: 22_2_0006B2B5 OpenClipboard,GetClipboardData,CloseClipboard,

22_2_0006B2B5

Source: C:\Users\user\task.exe	Code function: 22_2_00074C52 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	22_2_00074C52
Source: C:\Users\user\task.exe	Code function: 24_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	24_2_0040987A
Source: C:\Users\user\task.exe	Code function: 24_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	24_2_004098E2

Source: C:\Users\user\task.exe

Code function: 22_2_0006B2B5 OpenClipboard,GetClipboardData,CloseClipboard,

22_2_0006B2B5

Source: C:\Users\user\task.exe

Code function: 22_2_00069F7D GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

22_2_00069F7D

Source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_655acf23-d

Source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_d8b5a7e2-6

Source: Yara match	File source: 31.3.svchost.exe.5430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.task.exe.2b50000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.task.exe.2d70000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.svchost.exe.5430000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.task.exe.2d70000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.svchost.exe.5430000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.svchost.exe.5650000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: task.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2148, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4490232230.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: task.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: task.exe PID: 1272, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\task.exe

Code function: 22_2_0007AC11 SystemParametersInfoW,

22_2_0007AC11

System Summary

Malicious sample detected (through community Yara rule)

Source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.1571921794.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\task.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Memory allocated: 75760000 page execute and read and write	Jump to behavior
Source: C:\Users\user\task.exe	Memory allocated: 75760000 page execute and read and write	Jump to behavior
Source: C:\Users\user\task.exe	Memory allocated: 75760000 page execute and read and write

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DC7F0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	8_2_6C8DC7F0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DC910 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	8_2_6C8DC910
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7C7F0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	22_2_6FE7C7F0
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7C910 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	22_2_6FE7C910
Source: C:\Users\user\task.exe	Code function: 22_2_00076447 GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	22_2_00076447
Source: C:\Users\user\task.exe	Code function: 22_2_00071673 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	22_2_00071673
Source: C:\Users\user\task.exe	Code function: 22_2_00079CD4 OpenProcess,NtSuspendProcess,CloseHandle,	22_2_00079CD4
Source: C:\Users\user\task.exe	Code function: 22_2_00079D00 OpenProcess,NtResumeProcess,CloseHandle,	22_2_00079D00
Source: C:\Users\user\task.exe	Code function: 24_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,	24_2_0040DD85
Source: C:\Users\user\task.exe	Code function: 24_2_00401806 NtdllDefWindowProc_W,	24_2_00401806
Source: C:\Users\user\task.exe	Code function: 24_2_004018C0 NtdllDefWindowProc_W,	24_2_004018C0

Source: C:\Users\user\task.exe

Code function: 22_2_00074B45 ExitWindowsEx,LoadLibraryA,GetProcAddress,

22_2_00074B45

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\434f23.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{0028494D-9E28-4DD9-A336-17E8D634DF88}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI509A.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI509A.tmp

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_3_05095E98	8_3_05095E98
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_3_050929E0	8_3_050929E0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_3_050950C0	8_3_050950C0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_3_05099AE0	8_3_05099AE0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8F6CC1	8_2_6C8F6CC1
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8FED3B	8_2_6C8FED3B
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8FE890	8_2_6C8FE890
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DE970	8_2_6C8DE970
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DE480	8_2_6C8DE480
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8E2570	8_2_6C8E2570
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8E87C0	8_2_6C8E87C0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8E6700	8_2_6C8E6700
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8E8290	8_2_6C8E8290
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8EBDA0	8_2_6C8EBDA0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8D7F41	8_2_6C8D7F41
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8EB8F0	8_2_6C8EB8F0
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8E3960	8_2_6C8E3960
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C903AF1	8_2_6C903AF1
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DFB30	8_2_6C8DFB30
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DD170	8_2_6C8DD170
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_02648273	8_2_02648273
Source: C:\Users\user\task.exe	Code function: 22_2_6FE9ED3B	22_2_6FE9ED3B
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7E970	22_2_6FE7E970
Source: C:\Users\user\task.exe	Code function: 22_2_6FE9E890	22_2_6FE9E890
Source: C:\Users\user\task.exe	Code function: 22_2_6FE887C0	22_2_6FE887C0
Source: C:\Users\user\task.exe	Code function: 22_2_6FE86700	22_2_6FE86700
Source: C:\Users\user\task.exe	Code function: 22_2_6FE82570	22_2_6FE82570
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7E480	22_2_6FE7E480
Source: C:\Users\user\task.exe	Code function: 22_2_6FE88290	22_2_6FE88290
Source: C:\Users\user\task.exe	Code function: 22_2_6FE77F41	22_2_6FE77F41
Source: C:\Users\user\task.exe	Code function: 22_2_6FE8BDA0	22_2_6FE8BDA0
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7FB30	22_2_6FE7FB30
Source: C:\Users\user\task.exe	Code function: 22_2_6FEA3AF1	22_2_6FEA3AF1
Source: C:\Users\user\task.exe	Code function: 22_2_6FE83960	22_2_6FE83960
Source: C:\Users\user\task.exe	Code function: 22_2_6FE8B8F0	22_2_6FE8B8F0
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7D170	22_2_6FE7D170
Source: C:\Users\user\task.exe	Code function: 22_2_00085219	22_2_00085219
Source: C:\Users\user\task.exe	Code function: 22_2_0009128C	22_2_0009128C
Source: C:\Users\user\task.exe	Code function: 22_2_000942B0	22_2_000942B0
Source: C:\Users\user\task.exe	Code function: 22_2_000722DB	22_2_000722DB
Source: C:\Users\user\task.exe	Code function: 22_2_00097307	22_2_00097307
Source: C:\Users\user\task.exe	Code function: 22_2_0007D367	22_2_0007D367
Source: C:\Users\user\task.exe	Code function: 22_2_0009D4CC	22_2_0009D4CC
Source: C:\Users\user\task.exe	Code function: 22_2_000965BE	22_2_000965BE
Source: C:\Users\user\task.exe	Code function: 22_2_000A1670	22_2_000A1670
Source: C:\Users\user\task.exe	Code function: 22_2_000AB680	22_2_000AB680
Source: C:\Users\user\task.exe	Code function: 22_2_0009D6FB	22_2_0009D6FB
Source: C:\Users\user\task.exe	Code function: 22_2_0009773C	22_2_0009773C
Source: C:\Users\user\task.exe	Code function: 22_2_000938AE	22_2_000938AE
Source: C:\Users\user\task.exe	Code function: 22_2_000858B7	22_2_000858B7
Source: C:\Users\user\task.exe	Code function: 22_2_0009D92A	22_2_0009D92A
Source: C:\Users\user\task.exe	Code function: 22_2_000859FA	22_2_000859FA
Source: C:\Users\user\task.exe	Code function: 22_2_00096ABA	22_2_00096ABA
Source: C:\Users\user\task.exe	Code function: 22_2_000ABD29	22_2_000ABD29
Source: C:\Users\user\task.exe	Code function: 22_2_00084D22	22_2_00084D22
Source: C:\Users\user\task.exe	Code function: 22_2_0007BDB0	22_2_0007BDB0
Source: C:\Users\user\task.exe	Code function: 22_2_00096ED2	22_2_00096ED2
Source: C:\Users\user\task.exe	Code function: 22_2_000AFF04	22_2_000AFF04
Source: C:\Users\user\task.exe	Code function: 22_2_000B3FD0	22_2_000B3FD0
Source: C:\Users\user\task.exe	Code function: 22_2_10017194	22_2_10017194
Source: C:\Users\user\task.exe	Code function: 22_2_1000B5C1	22_2_1000B5C1
Source: C:\Users\user\task.exe	Code function: 22_2_02575322	22_2_02575322
Source: C:\Users\user\task.exe	Code function: 22_2_0258D395	22_2_0258D395
Source: C:\Users\user\task.exe	Code function: 22_2_02586029	22_2_02586029
Source: C:\Users\user\task.exe	Code function: 22_2_025910DB	22_2_025910DB
Source: C:\Users\user\task.exe	Code function: 22_2_0259B0EB	22_2_0259B0EB
Source: C:\Users\user\task.exe	Code function: 22_2_0258D166	22_2_0258D166
Source: C:\Users\user\task.exe	Code function: 22_2_0257478D	22_2_0257478D
Source: C:\Users\user\task.exe	Code function: 22_2_02575465	22_2_02575465
Source: C:\Users\user\task.exe	Code function: 22_2_0256B81B	22_2_0256B81B
Source: C:\Users\user\task.exe	Code function: 22_2_0258CF37	22_2_0258CF37
Source: C:\Users\user\task.exe	Code function: 22_2_02580CF7	22_2_02580CF7
Source: C:\Users\user\task.exe	Code function: 22_2_02574C84	22_2_02574C84
Source: C:\Users\user\task.exe	Code function: 22_2_02583D1B	22_2_02583D1B
Source: C:\Users\user\task.exe	Code function: 22_2_0256CDD2	22_2_0256CDD2
Source: C:\Users\user\task.exe	Code function: 24_2_0044B040	24_2_0044B040
Source: C:\Users\user\task.exe	Code function: 24_2_0043610D	24_2_0043610D
Source: C:\Users\user\task.exe	Code function: 24_2_00447310	24_2_00447310
Source: C:\Users\user\task.exe	Code function: 24_2_0044A490	24_2_0044A490
Source: C:\Users\user\task.exe	Code function: 24_2_0040755A	24_2_0040755A
Source: C:\Users\user\task.exe	Code function: 24_2_0043C560	24_2_0043C560
Source: C:\Users\user\task.exe	Code function: 24_2_0044B610	24_2_0044B610
Source: C:\Users\user\task.exe	Code function: 24_2_0044D6C0	24_2_0044D6C0
Source: C:\Users\user\task.exe	Code function: 24_2_004476F0	24_2_004476F0
Source: C:\Users\user\task.exe	Code function: 24_2_0044B870	24_2_0044B870
Source: C:\Users\user\task.exe	Code function: 24_2_0044081D	24_2_0044081D
Source: C:\Users\user\task.exe	Code function: 24_2_00414957	24_2_00414957
Source: C:\Users\user\task.exe	Code function: 24_2_004079EE	24_2_004079EE
Source: C:\Users\user\task.exe	Code function: 24_2_00407AEB	24_2_00407AEB
Source: C:\Users\user\task.exe	Code function: 24_2_0044AA80	24_2_0044AA80
Source: C:\Users\user\task.exe	Code function: 24_2_00412AA9	24_2_00412AA9
Source: C:\Users\user\task.exe	Code function: 24_2_00404B74	24_2_00404B74
Source: C:\Users\user\task.exe	Code function: 24_2_00404B03	24_2_00404B03
Source: C:\Users\user\task.exe	Code function: 24_2_0044BBD8	24_2_0044BBD8
Source: C:\Users\user\task.exe	Code function: 24_2_00404BE5	24_2_00404BE5
Source: C:\Users\user\task.exe	Code function: 24_2_00404C76	24_2_00404C76
Source: C:\Users\user\task.exe	Code function: 24_2_00415CFE	24_2_00415CFE
Source: C:\Users\user\task.exe	Code function: 24_2_00416D72	24_2_00416D72
Source: C:\Users\user\task.exe	Code function: 24_2_00446D30	24_2_00446D30
Source: C:\Users\user\task.exe	Code function: 24_2_00446D8B	24_2_00446D8B
Source: C:\Users\user\task.exe	Code function: 24_2_00406E8F	24_2_00406E8F

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\67a1ae3c4a36f34f89fd14e4fff5e74c.tmp 796EA1D27ED5825E300C3C9505A87B2445886623235F3E41258DE90BA1604CD5

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: String function: 6C8F12B0 appears 36 times
Source: C:\Users\user\task.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Users\user\task.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Users\user\task.exe	Code function: String function: 6FE912B0 appears 36 times
Source: C:\Users\user\task.exe	Code function: String function: 000620BD appears 46 times
Source: C:\Users\user\task.exe	Code function: String function: 00092100 appears 42 times
Source: C:\Users\user\task.exe	Code function: String function: 02581B6B appears 41 times
Source: C:\Users\user\task.exe	Code function: String function: 0258224B appears 47 times
Source: C:\Users\user\task.exe	Code function: String function: 00061E82 appears 33 times
Source: C:\Users\user\task.exe	Code function: String function: 000927E0 appears 54 times
Source: C:\Users\user\task.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Users\user\task.exe	Code function: String function: 00416760 appears 69 times

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 976

Source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.1571921794.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: task.exe, 00000016.00000003.1652380221.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647531865.0000000003CAF000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649253542.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652045010.0000000003ECC000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647738667.0000000003CAF000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652977874.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650539674.0000000003F3A000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652572952.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647629402.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651396491.0000000004015000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647833006.0000000000871000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: task.exe, 00000016.00000003.1652380221.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647531865.0000000003CAF000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649253542.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652045010.0000000003ECC000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647738667.0000000003CAF000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652977874.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650539674.0000000003F3A000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652572952.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647629402.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651396491.0000000004015000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647833006.0000000000871000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.evad.winMSI@70/148@12/12

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8DCAF0 GetModuleHandleW,FormatMessageW,GetLastError,

8_2_6C8DCAF0

Source: C:\Users\user\task.exe

Code function: 22_2_00075C8A GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

22_2_00075C8A

Source: C:\Users\user\task.exe

Code function: 24_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

24_2_00418758

Source: C:\Users\user\task.exe

Code function: 22_2_0006E45A CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

22_2_0006E45A

Source: C:\Users\user\task.exe

Code function: 22_2_00079789 FindResourceA,LoadResource,LockResource,SizeofResource,

22_2_00079789

Source: C:\Users\user\task.exe

Code function: 22_2_00078D0C OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

22_2_00078D0C

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

File created: C:\Users\user\apps.bat

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Mutant created: \Sessions\1\BaseNamedObjects\zRRdyPN41SkDaS8h3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7880
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_03
Source: C:\Users\user\task.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-RNN6CM
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-a34ef0fe-40fa-1ddbcb-aeea2ee60c14}

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF218C22ED6F4C8576.TMP

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "

Source: C:\Users\user\task.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\msiwrapper.ini

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp, task.exe, 0000001A.00000002.1666220432.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: task.exe, 00000016.00000002.4496169757.0000000002FF0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: task.exe, 00000018.00000002.1685578220.0000000002736000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1879011150.000001BE85C37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1878511893.000001BE85617000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1903680405.000001BE85617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: task.exe, task.exe, 00000018.00000002.1684002660.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: wE1inOhJA5.msi

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\wE1inOhJA5.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E1280F90D0867DD413F7EEEF5D19EFB6
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\expand.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe"
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 976
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\gifwhgt"
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\jckohyeeyyu"
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\tfphirpfmgmayj"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"
Source: C:\Users\user\task.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrFE01.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/6c77fc35"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2376,i,16818295695986717264,7118115118329945779,262144 /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr6BC.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/32916e99"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=2100,i,4541570122865520646,14461282582081406380,262144 /prefetch:3
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E1280F90D0867DD413F7EEEF5D19EFB6	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\gifwhgt"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\jckohyeeyyu"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\tfphirpfmgmayj"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrFE01.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/6c77fc35"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chr6BC.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/32916e99"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2376,i,16818295695986717264,7118115118329945779,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=2100,i,4541570122865520646,14461282582081406380,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: g2m.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: g2m.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\task.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\task.exe	Section loaded: wldp.dll
Source: C:\Users\user\task.exe	Section loaded: pstorec.dll
Source: C:\Users\user\task.exe	Section loaded: sspicli.dll
Source: C:\Users\user\task.exe	Section loaded: msasn1.dll
Source: C:\Users\user\task.exe	Section loaded: msasn1.dll
Source: C:\Users\user\task.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\task.exe	Section loaded: wldp.dll
Source: C:\Users\user\task.exe	Section loaded: msasn1.dll
Source: C:\Users\user\task.exe	Section loaded: sspicli.dll
Source: C:\Users\user\task.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\task.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\task.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\task.exe	Section loaded: g2m.dll
Source: C:\Users\user\task.exe	Section loaded: winmm.dll
Source: C:\Users\user\task.exe	Section loaded: urlmon.dll
Source: C:\Users\user\task.exe	Section loaded: iertutil.dll
Source: C:\Users\user\task.exe	Section loaded: srvcli.dll
Source: C:\Users\user\task.exe	Section loaded: netutils.dll
Source: C:\Users\user\task.exe	Section loaded: wininet.dll
Source: C:\Users\user\task.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\task.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\task.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\task.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\task.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\msiwrapper.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Detected unpacking (changes PE section rights)

Source: C:\Users\user\task.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: wE1inOhJA5.msi

Static file information: File size 1753088 > 1048576

Source:	Binary string: your_package_name.pdbG source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1573600735.000000006C906000.00000002.00000001.01000000.00000006.sdmp, task.exe, 00000008.00000003.1472143930.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000016.00000002.4498290278.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp, task.exe, 0000001E.00000002.4491311882.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: wkernel32.pdb source: task.exe, 00000019.00000003.1667788844.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1667935272.0000000002C70000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676696250.0000000005550000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676535563.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1572618363.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: task.exe, 00000019.00000003.1664725236.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1665323555.0000000002D40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675135210.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675381954.0000000005620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: your_package_name.pdbI source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: task.exe, 00000019.00000003.1665989629.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1666587570.0000000002CF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675802717.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676138788.00000000055D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: task.exe, 00000019.00000003.1664725236.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1665323555.0000000002D40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675135210.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675381954.0000000005620000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: task.exe, 00000019.00000003.1665989629.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1666587570.0000000002CF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1675802717.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676138788.00000000055D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\<.oeaccount source: task.exe, 0000001A.00000002.1666589979.000000000061C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: your_package_name.pdb source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1573600735.000000006C906000.00000002.00000001.01000000.00000006.sdmp, task.exe, 00000008.00000003.1472143930.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000016.00000002.4498290278.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp, task.exe, 0000001E.00000002.4491311882.000000006FEA6000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: task.exe, 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: task.exe, 00000019.00000003.1667788844.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, task.exe, 00000019.00000003.1667935272.0000000002C70000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676696250.0000000005550000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.1676535563.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: expand.exe, 00000006.00000003.1433042313.000000000482F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: expand.exe, 00000006.00000003.1433042313.00000000046D4000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000008.00000002.1572618363.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, task.exe, 00000008.00000002.1571419937.0000000000402000.00000002.00000001.01000000.00000005.sdmp, task.exe, 00000008.00000000.1439408986.0000000000402000.00000002.00000001.01000000.00000005.sdmp, task.exe, 00000016.00000000.1579511832.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000016.00000002.4486274195.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000018.00000000.1650674244.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 00000019.00000002.1675825905.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001A.00000000.1651000866.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001B.00000000.1652070836.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001E.00000002.4486356902.0000000000402000.00000002.00000001.01000000.0000000A.sdmp, task.exe, 0000001E.00000000.1662738715.0000000000402000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\. source: task.exe, 0000001A.00000002.1666589979.0000000000608000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Users\user\task.exe	Unpacked PE file: 24.2.task.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.CRT:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\task.exe	Unpacked PE file: 26.2.task.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.CRT:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\task.exe	Unpacked PE file: 27.2.task.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.CRT:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

.NET source code contains potential unpacker

Source: 32.3.svchost.exe.1be856bc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 32.3.svchost.exe.1be856bc070.1.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 32.3.svchost.exe.1be856bc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 32.3.svchost.exe.1be856bc070.0.raw.unpack, Runtime.cs	.Net Code: CoreMain

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8DB840 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,ReleaseMutex,

8_2_6C8DB840

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8C8720 push eax; mov dword ptr [esp], 00000007h	8_2_6C8C8721
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C904201 push ecx; ret	8_2_6C904214
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8B1830 push eax; mov dword ptr [esp], 00000000h	8_2_6C8B1831
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8CB0C0 push eax; mov dword ptr [esp], 00000000h	8_2_6C8CB0C1
Source: C:\Users\user\task.exe	Code function: 22_2_6FE68720 push eax; mov dword ptr [esp], 00000007h	22_2_6FE68721
Source: C:\Users\user\task.exe	Code function: 22_2_6FEA4201 push ecx; ret	22_2_6FEA4214
Source: C:\Users\user\task.exe	Code function: 22_2_6FE51830 push eax; mov dword ptr [esp], 00000000h	22_2_6FE51831
Source: C:\Users\user\task.exe	Code function: 22_2_6FE6B0C0 push eax; mov dword ptr [esp], 00000000h	22_2_6FE6B0C1
Source: C:\Users\user\task.exe	Code function: 22_2_000B3076 push ecx; ret	22_2_000B3089
Source: C:\Users\user\task.exe	Code function: 22_2_00092826 push ecx; ret	22_2_00092839
Source: C:\Users\user\task.exe	Code function: 22_2_000B3998 push eax; ret	22_2_000B39B6
Source: C:\Users\user\task.exe	Code function: 22_2_10002806 push ecx; ret	22_2_10002819
Source: C:\Users\user\task.exe	Code function: 22_2_02582291 push ecx; ret	22_2_025822A4
Source: C:\Users\user\task.exe	Code function: 22_2_0255811E push ebx; ret	22_2_0255811F
Source: C:\Users\user\task.exe	Code function: 22_2_0255C78E pushfd ; retf	22_2_0255C78F
Source: C:\Users\user\task.exe	Code function: 22_2_025A3403 push eax; ret	22_2_025A3421
Source: C:\Users\user\task.exe	Code function: 22_2_02572496 push esi; ret	22_2_02572498
Source: C:\Users\user\task.exe	Code function: 22_2_025A2AE1 push ecx; ret	22_2_025A2AF4
Source: C:\Users\user\task.exe	Code function: 22_2_025C5C6B push edx; ret	22_2_025C5CDB
Source: C:\Users\user\task.exe	Code function: 24_2_0044693D push ecx; ret	24_2_0044694D
Source: C:\Users\user\task.exe	Code function: 24_2_0044DB70 push eax; ret	24_2_0044DB84
Source: C:\Users\user\task.exe	Code function: 24_2_0044DB70 push eax; ret	24_2_0044DBAC
Source: C:\Users\user\task.exe	Code function: 24_2_00451D54 push eax; ret	24_2_00451D61

Source: C:\Users\user\task.exe

Code function: 22_2_00066F61 ShellExecuteW,URLDownloadToFileW,

22_2_00066F61

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI509A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\67a1ae3c4a36f34f89fd14e4fff5e74c.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\g2m.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\87377860be1e204a95d069480a67ac12.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\your_package_name.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\75aedfde5bde214c9f1dda9d9e9a381f.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\task.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\g2m.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\task.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\g2m.dll			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI509A.tmp

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\task.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	File created: C:\Users\user\g2m.dll			Jump to dropped file

Source: C:\Users\user\task.exe

Code function: 22_2_00078D0C OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

22_2_00078D0C

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run apps			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run apps			Jump to behavior

Source: C:\Users\user\task.exe

Code function: 22_2_0007AD7F LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

22_2_0007AD7F

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\task.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\task.exe

Code function: 22_2_0006E304 Sleep,ExitProcess,

22_2_0006E304

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\task.exe	API/Special instruction interceptor: Address: 7FF90818D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FF90818D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 56FB83A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMECFF EXPLORER.EXE:
Source: task.exe, 00000016.00000003.1652380221.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649253542.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652045010.0000000003ECC000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652977874.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650539674.0000000003F3A000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652572952.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649361427.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651396491.0000000004015000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648863747.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4497721588.0000000004179000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: task.exe, 00000016.00000003.1652380221.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649253542.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652045010.0000000003ECC000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652977874.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650539674.0000000003F3A000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652572952.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649361427.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651396491.0000000004015000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648863747.0000000003C55000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4497721588.0000000004179000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\task.exe

Code function: 24_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,

24_2_0040DD85

Source: C:\Users\user\task.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

22_2_00078A3A

Source: C:\Users\user\task.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\task.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\task.exe	Window / User API: threadDelayed 4633			Jump to behavior
Source: C:\Users\user\task.exe	Window / User API: threadDelayed 5346			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI509A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\87377860be1e204a95d069480a67ac12.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\your_package_name.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\75aedfde5bde214c9f1dda9d9e9a381f.tmp	Jump to dropped file

Source: C:\Users\user\task.exe TID: 1080	Thread sleep count: 4633 > 30	Jump to behavior
Source: C:\Users\user\task.exe TID: 1080	Thread sleep time: -13899000s >= -30000s	Jump to behavior
Source: C:\Users\user\task.exe TID: 1080	Thread sleep count: 5346 > 30	Jump to behavior
Source: C:\Users\user\task.exe TID: 1080	Thread sleep time: -16038000s >= -30000s	Jump to behavior
Source: C:\Users\user\task.exe TID: 5940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\task.exe TID: 4712	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8FB0E1 FindFirstFileExW,	8_2_6C8FB0E1
Source: C:\Users\user\task.exe	Code function: 22_2_6FE9B0E1 FindFirstFileExW,	22_2_6FE9B0E1
Source: C:\Users\user\task.exe	Code function: 22_2_0006BF45 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	22_2_0006BF45
Source: C:\Users\user\task.exe	Code function: 22_2_0006919E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	22_2_0006919E
Source: C:\Users\user\task.exe	Code function: 22_2_00068290 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	22_2_00068290
Source: C:\Users\user\task.exe	Code function: 22_2_000672F0 FindFirstFileW,FindNextFileW,	22_2_000672F0
Source: C:\Users\user\task.exe	Code function: 22_2_0007A467 FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,	22_2_0007A467
Source: C:\Users\user\task.exe	Code function: 22_2_0006B6E8 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	22_2_0006B6E8
Source: C:\Users\user\task.exe	Code function: 22_2_000A97E9 FindFirstFileExA,	22_2_000A97E9
Source: C:\Users\user\task.exe	Code function: 22_2_0006B903 FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	22_2_0006B903
Source: C:\Users\user\task.exe	Code function: 22_2_00068D46 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	22_2_00068D46
Source: C:\Users\user\task.exe	Code function: 22_2_00077DE7 FindFirstFileW,FindNextFileW,FindNextFileW,	22_2_00077DE7
Source: C:\Users\user\task.exe	Code function: 22_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	22_2_100010F1
Source: C:\Users\user\task.exe	Code function: 22_2_10006580 FindFirstFileExA,	22_2_10006580
Source: C:\Users\user\task.exe	Code function: 24_2_0040AE51 FindFirstFileW,FindNextFileW,	24_2_0040AE51

Source: C:\Users\user\task.exe

Code function: 22_2_0006771B SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

22_2_0006771B

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8C93B0 GetSystemInfo,

8_2_6C8C93B0

Source: C:\Users\user\task.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\task.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat

Source: svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: task.exe, 00000016.00000003.1648607977.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646821801.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649361427.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1639168513.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1643644507.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001F.00000002.1764735514.000000000325C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRSVP UDPv6 Service Provider
Source: svchost.exe, 0000001F.00000002.1764690354.0000000003212000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: svchost.exe, 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: task.exe, 0000001E.00000002.4488282758.0000000000527000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8D8D40 LdrInitializeThunk,WSAStartup,WSACleanup,

8_2_6C8D8D40

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8F84FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_6C8F84FB

Source: C:\Users\user\task.exe

24_2_0040DD85

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

8_2_6C8DB840

Source: C:\Users\user\task.exe	Code function: 22_2_0009FDBE mov eax, dword ptr fs:[00000030h]	22_2_0009FDBE
Source: C:\Users\user\task.exe	Code function: 22_2_10004AB4 mov eax, dword ptr fs:[00000030h]	22_2_10004AB4
Source: C:\Users\user\task.exe	Code function: 22_2_0258F829 mov eax, dword ptr fs:[00000030h]	22_2_0258F829

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C904D50 GetProcessHeap,HeapAlloc,

8_2_6C904D50

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8F84FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6C8F84FB
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8F1134 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6C8F1134
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8F12F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6C8F12F8
Source: C:\Users\user\task.exe	Code function: 22_2_6FE984FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_6FE984FB
Source: C:\Users\user\task.exe	Code function: 22_2_6FE912F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_6FE912F8
Source: C:\Users\user\task.exe	Code function: 22_2_6FE91134 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_6FE91134
Source: C:\Users\user\task.exe	Code function: 22_2_00092484 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00092484
Source: C:\Users\user\task.exe	Code function: 22_2_000994A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000994A3
Source: C:\Users\user\task.exe	Code function: 22_2_0009297F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_0009297F
Source: C:\Users\user\task.exe	Code function: 22_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_100060E2
Source: C:\Users\user\task.exe	Code function: 22_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_10002B1C
Source: C:\Users\user\task.exe	Code function: 22_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_10002639

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 179.43.171.196 5982

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 20A308F0000 protect: page read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\task.exe

Code function: 22_2_00076447 GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

22_2_00076447

Maps a DLL or memory area into another process

Source: C:\Users\user\task.exe	Section loaded: NULL target: C:\Users\user\task.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: NULL target: C:\Users\user\task.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: NULL target: C:\Users\user\task.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\task.exe	Section loaded: NULL target: C:\Users\user\task.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 20A308F0000
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF733CD14E0

Source: C:\Users\user\task.exe

Code function: 22_2_00077936 mouse_event,

22_2_00077936

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)LOW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\gifwhgt"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\jckohyeeyyu"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Users\user\task.exe C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\tfphirpfmgmayj"	Jump to behavior
Source: C:\Users\user\task.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\task.exe "task.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: task.exe, 00000016.00000002.4497115014.0000000003660000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: task.exe, 00000016.00000002.4497115014.0000000003660000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageru
Source: task.exe, 00000016.00000002.4490232230.0000000000879000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8F141F cpuid

8_2_6C8F141F

Source: C:\Users\user\task.exe	Code function: GetLocaleInfoA,	22_2_0006E42E
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	22_2_000AF090
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,	22_2_000A50DE
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,	22_2_000AF197
Source: C:\Users\user\task.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	22_2_000AF264
Source: C:\Users\user\task.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	22_2_000AE92C
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,	22_2_000AEAFB
Source: C:\Users\user\task.exe	Code function: EnumSystemLocalesW,	22_2_000AEBA4
Source: C:\Users\user\task.exe	Code function: EnumSystemLocalesW,	22_2_000A4BD6
Source: C:\Users\user\task.exe	Code function: EnumSystemLocalesW,	22_2_000AEBEF
Source: C:\Users\user\task.exe	Code function: EnumSystemLocalesW,	22_2_000AEC8A
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	22_2_000AED17
Source: C:\Users\user\task.exe	Code function: GetLocaleInfoW,	22_2_000AEF67

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\data.bin VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\task.exe	Queries volume information: C:\Users\user\data.bin VolumeInformation	Jump to behavior
Source: C:\Users\user\task.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\task.exe	Queries volume information: C:\Users\user\data.bin VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe

Code function: 8_2_6C8F0D83 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_6C8F0D83

Source: C:\Users\user\task.exe

Code function: 22_2_000798EE GetComputerNameExW,GetUserNameW,

22_2_000798EE

Source: C:\Users\user\task.exe

Code function: 22_2_000A5981 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

22_2_000A5981

Source: C:\Users\user\task.exe

Code function: 24_2_0041739B GetVersionExW,

24_2_0041739B

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected RHADAMANTHYS Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 0000001F.00000003.1672134784.0000000003480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1674900501.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1662192131.0000000000580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1765068419.0000000003490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4490232230.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: task.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: task.exe PID: 1272, type: MEMORYSTR

Source: C:\Users\user\task.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

22_2_0006B5CA

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\task.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		22_2_0006B6E8
Source: C:\Users\user\task.exe	Code function: \key3.db		22_2_0006B6E8

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\safebrowsing
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\ca4gppea.default
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\doomed
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\safebrowsing\google4
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\entries
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\thumbnails
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\settings\main\ms-language-packs\browser
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\settings\main\ms-language-packs\browser\newtab
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\settings\main\ms-language-packs
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\settings\main
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
Source: C:\Users\user\task.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\startupCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\task.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: Process Memory Space: task.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: task.exe PID: 716, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 2968, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\task.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RNN6CM			Jump to behavior
Source: C:\Users\user\task.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RNN6CM

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000001F.00000003.1672134784.0000000003480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1674900501.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1662192131.0000000000580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1765068419.0000000003490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 22.2.task.exe.255066b.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.255066b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.task.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.task.exe.6066b.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4490232230.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: task.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: task.exe PID: 1272, type: MEMORYSTR

Source: C:\Users\user\task.exe

Code function: cmd.exe

22_2_000657D6

Source: C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe	Code function: 8_2_6C8DF8E0 bind,listen,WSAGetLastError,closesocket,		8_2_6C8DF8E0
Source: C:\Users\user\task.exe	Code function: 22_2_6FE7F8E0 bind,listen,WSAGetLastError,closesocket,		22_2_6FE7F8E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	131 Input Capture	11 Peripheral Device Discovery	Remote Desktop Protocol	11 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	1 Windows Service	2 Software Packing	3 Credentials In Files	1 System Service Discovery	Distributed Component Object Model	131 Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Services File Permissions Weakness	512 Process Injection	1 DLL Side-Loading	LSA Secrets	15 File and Directory Discovery	SSH	3 Clipboard Data	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	1310 System Information Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Services File Permissions Weakness	1 Extra Window Memory Injection	DCSync	351 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Masquerading	Proc Filesystem	51 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	4 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	512 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Services File Permissions Weakness	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wE1inOhJA5.msi	45%	ReversingLabs	Win32.Backdoor.Remcos

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\bce5c9c7fb0eb5498f5eb0ff4df1bd89.tmp	100%	Avira	BAT/Runner.wekvp
C:\Users\user\apps.bat	100%	Avira	BAT/Runner.wekvp
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\67a1ae3c4a36f34f89fd14e4fff5e74c.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\75aedfde5bde214c9f1dda9d9e9a381f.tmp	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\87377860be1e204a95d069480a67ac12.tmp	67%	ReversingLabs	Win32.Adware.RedCap
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\g2m.dll (copy)	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\your_package_name.dll (copy)	67%	ReversingLabs	Win32.Adware.RedCap
C:\Users\user\g2m.dll	29%	ReversingLabs
C:\Users\user\task.exe	0%	ReversingLabs
C:\Windows\Installer\MSI509A.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
rm.anonbaba.net	100%	Avira URL Cloud	malware
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txna	0%	Avira URL Cloud	safe
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnas	0%	Avira URL Cloud	safe
http://127.0	0%	Avira URL Cloud	safe
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnaymb	0%	Avira URL Cloud	safe
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnakernelbasentdllkernel32GetProcessMitigati	0%	Avira URL Cloud	safe
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnax	0%	Avira URL Cloud	safe
http://www.imvu.coma	0%	Avira URL Cloud	safe
http://127.01:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ntp.nict.jp	61.205.120.130	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
rm.anonbaba.net	179.43.171.197	true	true	unknown
geoplugin.net	178.237.33.50	true	false	high
ntp1.net.berkeley.edu	169.229.128.134	true	false	unknown
ntp.time.in.ua	62.149.0.30	true	false	high
time-a-g.nist.gov	129.6.15.28	true	false	high
ts1.aco.net	193.171.23.163	true	false	unknown
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txna	true	Avira URL Cloud: safe	unknown
rm.anonbaba.net	true	Avira URL Cloud: malware	unknown
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp$	task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1645514022.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648455258.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnas	svchost.exe, 00000020.00000002.2171115892.000001BE8295E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.imvu.comr	task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnax	svchost.exe, 0000001F.00000002.1764466512.0000000000C7C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gphy	task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1645514022.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648455258.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649057788.0000000000869000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1639168513.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647020161.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.com	task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1656628346.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cloudflare-dns.com/dns-query	svchost.exe, 0000001F.00000003.1695689800.000000000339F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnaymb	svchost.exe, 00000020.00000003.2169208927.000001BE856B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.coma	task.exe, 0000001B.00000002.1656628346.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nirsoft.net	task.exe, 00000018.00000002.1683843310.0000000000193000.00000004.00000010.00020000.00000000.sdmp	false		high
https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi	svchost.exe, 0000001F.00000003.1695689800.000000000339F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp6	task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1686427068.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4490232230.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1685975988.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
http://127.01:	svchost.exe, 00000020.00000003.1949101503.000001BE85629000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://www.catcert.net/verarrel	msedge.exe, 00000026.00000002.1935253683.00001C0003170000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp/C	task.exe, 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, task.exe, 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, task.exe, 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, task.exe, 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp	false		high
http://127.0	svchost.exe, 00000020.00000003.1949101503.000001BE85629000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpN	task.exe, 00000016.00000003.1640544536.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1650331166.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1647273159.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648907336.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642454762.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648293959.0000000000871000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1642187022.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641987804.0000000000870000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1648139673.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1649617657.0000000000874000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1686427068.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1638859407.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1652161168.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1641701441.0000000000875000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1651088954.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000002.4490232230.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640814728.000000000086C000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1685975988.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646658676.000000000086D000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1640250134.0000000000879000.00000004.00000020.00020000.00000000.sdmp, task.exe, 00000016.00000003.1646278220.0000000000869000.00000004.00000020.00020000.00000000.sdmp	false		high
https://179.43.171.196:5982/c329ffe03228fab8/o0tr85tn.5txnakernelbasentdllkernel32GetProcessMitigati	svchost.exe, 0000001F.00000002.1764768294.000000000330C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/accounts/servicelogin	task.exe	false		high
https://login.yahoo.com/config/login	task.exe	false		high
http://www.nirsoft.net/	task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	svchost.exe, 00000020.00000003.1876727727.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.1877374560.000001BE8562A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ebuddy.com	task.exe, 00000016.00000002.4497866772.00000000041C0000.00000040.10000000.00040000.00000000.sdmp, task.exe, 0000001B.00000002.1655472642.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
179.43.171.196	unknown	Panama	51852	PLI-ASCH	true
62.149.0.30	ntp.time.in.ua	Ukraine	15497	COLOCALLInternetDataCenterColoCALLUA	false
169.229.128.134	ntp1.net.berkeley.edu	United States	25	UCBUS	false
129.6.15.28	time-a-g.nist.gov	United States	49	US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	false
193.171.23.163	ts1.aco.net	Austria	1853	ACONETACOnetBackboneAT	false
179.43.171.197	rm.anonbaba.net	Panama	51852	PLI-ASCH	true
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
61.205.120.130	ntp.nict.jp	Japan	17511	OPTAGEOPTAGEIncJP	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560070
Start date and time:	2024-11-21 11:25:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wE1inOhJA5.msi renamed because original name is a hash value
Original Sample Name:	ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000.msi
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.evad.winMSI@70/148@12/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 166 Number of non-executed functions: 219
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer Override analysis time to 119996.6473 for current running targets taking high CPU consumption Override analysis time to 239993.2946 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 17.253.52.125, 17.253.14.251, 17.253.14.125, 20.101.57.9, 158.220.97.17, 144.76.59.37, 85.220.190.246, 195.201.137.97, 142.250.74.195, 142.250.181.238, 142.250.110.84, 13.107.42.16, 142.250.185.142, 13.107.21.239, 204.79.197.239, 13.107.6.158
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, twc.trafficmanager.net, clientservices.googleapis.com, clients2.google.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, time.g.aaplimg.com, l-0007.l-msedge.net, config.edge.skype.com, pool.ntp.org, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, time.apple.com, onedsblobprdwus15.westus.cloudapp.azure.com, b-0005.b-msedge.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, business.bing.com, clients.l.google.com, dual-a-0036.a-msedge.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: wE1inOhJA5.msi

Simulations

Behavior and APIs

Time	Type	Description
05:26:49	API Interceptor	1x Sleep call for process: WerFault.exe modified
05:27:26	API Interceptor	4187475x Sleep call for process: task.exe modified
05:27:43	API Interceptor	1x Sleep call for process: wmplayer.exe modified
10:26:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run apps C:\Users\user\apps.bat
10:26:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run apps C:\Users\user\apps.bat

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	test2.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	test2.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	original.eml	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	WSock.dll	Get hash	malicious	Ramnit	Browse
239.255.255.250	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse
	http://newvideozones.click	Get hash	malicious	Unknown	Browse
	https://waydetrainers.us/PC.PDF	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779	Get hash	malicious	KnowBe4	Browse
	http://ahcli.comcastbiz.net	Get hash	malicious	Unknown	Browse
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse
	https://account.metasystemchat.com/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
129.6.15.28	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse
	mirai_nomi	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.28386.14039.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.22921.14172.elf	Get hash	malicious	Mirai	Browse
	PrHBHHWE5U.elf	Get hash	malicious	Mirai	Browse
	y99ZI1Kjg8.exe	Get hash	malicious	Unknown	Browse
	QP6s4u5SZ8.exe	Get hash	malicious	Unknown	Browse
178.237.33.50	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732147507ac10953a908ae794c5ee180add9124a78c69705135688e502bb56ce4453da749198.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732143786cec792bea7f8ce7f818c031173ce52fabd19dde842f74b07fc234dc9f3fa1dcf839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	sostener.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	Pago_BBVA.pdf.bat.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
time-a-g.nist.gov	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	129.6.15.28
	y99ZI1Kjg8.exe	Get hash	malicious	Unknown	Browse	129.6.15.28
	QP6s4u5SZ8.exe	Get hash	malicious	Unknown	Browse	129.6.15.28
	2X3f1ykTmM.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	kr.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	WjmYak325l.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	tgduMePOh0.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
	8AcNX5GzVY.exe	Get hash	malicious	Kronos	Browse	129.6.15.28
chrome.cloudflare-dns.com	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
geoplugin.net	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732147507ac10953a908ae794c5ee180add9124a78c69705135688e502bb56ce4453da749198.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732143786cec792bea7f8ce7f818c031173ce52fabd19dde842f74b07fc234dc9f3fa1dcf839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	Pago_BBVA.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLI-ASCH	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	179.43.182.252
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	81.17.20.50
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	190.211.254.101
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	190.211.254.192
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	81.17.25.195
	SCV.cmd	Get hash	malicious	Unknown	Browse	179.43.180.122
	SCV.cmd	Get hash	malicious	Unknown	Browse	179.43.180.122
	http://179.43.168.146	Get hash	malicious	Unknown	Browse	179.43.168.146
US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	132.163.96.1
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	129.6.15.27
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	132.163.96.2
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	132.163.97.1
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	132.163.97.3
	ExeFile (354).exe	Get hash	malicious	Unknown	Browse	132.163.97.1
	ExeFile (355).exe	Get hash	malicious	Unknown	Browse	132.163.96.3
	ExeFile (355).exe	Get hash	malicious	Unknown	Browse	132.163.97.4
	r2ye3b3z8R.elf	Get hash	malicious	Mirai	Browse	129.6.170.29
	SecuriteInfo.com.Win32.TrojanX-gen.30886.16837.exe	Get hash	malicious	Unknown	Browse	132.163.96.2
UCBUS	xd.m68k.elf	Get hash	malicious	Mirai	Browse	169.229.176.118
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	136.152.38.2
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	128.32.7.69
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	128.32.229.224
	mips.elf	Get hash	malicious	Unknown	Browse	128.32.7.74
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	136.152.133.22
	na.elf	Get hash	malicious	Mirai, Gafgyt	Browse	136.152.48.129
	firmware.arm-linux-gnueabihf.elf	Get hash	malicious	Unknown	Browse	136.152.48.198
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	128.32.187.9
	botx.x86.elf	Get hash	malicious	Mirai	Browse	136.152.211.90
COLOCALLInternetDataCenterColoCALLUA	http://pint77.com/	Get hash	malicious	Unknown	Browse	62.149.0.249
	DHL_2017128_Receipt_Document,pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.28.171.149
	DHL_2017128_Receipt_Document,pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.28.171.149
	DHL_2017128_Receipt_Document,pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.28.171.149
	https://www.todayville.com/meeting-the-threshold-justins-tantrum-gets-justice-rouleaus-approval	Get hash	malicious	Unknown	Browse	62.149.1.122
	4mn5eBrgiz.exe	Get hash	malicious	Unknown	Browse	62.149.1.122
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	62.149.1.122
	https://www3.myasiantv.cc/	Get hash	malicious	Unknown	Browse	62.149.1.122
	Numerology_+Magic+of+Personal+Numbers_2.0_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	31.28.169.132
	Numerology_+Magic+of+Personal+Numbers_2.0_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	31.28.169.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
caec7ddf6889590d999d7ca1b76373b6	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	UGcjMkPWwW.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	XAhzDHAVZ2.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	TctqdRX5Wq.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	g753nr4GI9.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	DCF368HPtv.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	ji2OQQH0ei.exe	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196
	zaD1vaze6V.ps1	Get hash	malicious	RHADAMANTHYS	Browse	179.43.171.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\67a1ae3c4a36f34f89fd14e4fff5e74c.tmp	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse
	7Y18r(14).exe	Get hash	malicious	LummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_task.exe_dca940beb5ac1855d24aeb3d9b5a56fbdf8779b_355c3592_19be0b05-7ace-4d33-8611-c7043441e604\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.144542314276748
Encrypted:	false
SSDEEP:	192:F0IjAITD0BU/HJ6jaz75guIdzuiFIZ24IO8q+i:+8dTwBU/QjIIzuiFIY4IO8G
MD5:	06BE0F5CDF95FB3BF4894239496AC721
SHA1:	490977DB5BBDCE5C0C093594528A4016ED474352
SHA-256:	A099429C4F93AD4B86BC37015706E622178860A5DD07A0298A481847BA32F650
SHA-512:	2E4CB351226E829DF72F7D494095B1C3A875446824D02F2FACBC4CB2D7A4008AAA4BAEF052A5621923149DB39C5F4B535E7E96B7A0A278CFCFB3427F32C68E36
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.6.5.8.3.9.9.9.5.5.7.1.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.6.5.8.4.0.1.1.5.8.8.3.5.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.b.e.0.b.0.5.-.7.a.c.e.-.4.d.3.3.-.8.6.1.1.-.c.7.0.4.3.4.4.1.e.6.0.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.2.8.e.d.6.a.-.7.5.9.a.-.4.1.6.2.-.b.0.9.5.-.6.d.3.9.3.9.1.0.e.c.4.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.a.s.k...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.G.2.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.c.8.-.0.0.0.1.-.0.0.1.4.-.1.a.7.5.-.c.a.d.7.f.f.3.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.d.8.6.d.5.e.1.c.a.7.e.a.4.a.a.7.3.3.7.8.1.e.5.d.d.7.e.4.f.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.d.c.c.2.d.c.b.2.6.c.1.6.4.9.8.8.7.f.1.d.5.a.e.5.5.7.a.0.0.0.b.5.f.e.3.4.b.b.9.8.!.t.a.s.k...

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A0E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 21 10:26:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	214721
Entropy (8bit):	3.518304425674418
Encrypted:	false
SSDEEP:	1536:UreP9CjBMjOASpe0wrCDstTJo6syCRuBojRwpN4uE2aOESVXJ8LTgeNkt:OScnpXW9o6sTHm4uEqEySLTgYk
MD5:	F94A7A94F68B2908845C028877187376
SHA1:	D9191B45A5A6734ACCCEABC037D2CAB9FFE5E85C
SHA-256:	7B4CD6E244177E849246B1C315871F02A83A251E88E91859E88BB15EF1F058E4
SHA-512:	CF506CA434D34E727E3668F9F0191E6ADA1A402B4E9C21AA3A9DECC5C59342F3763DA6B8336F63A3F3DBC2B3A1C45340FB014B4A38673E940F40746EAF630674
Malicious:	false
Preview:	MDMP..a..... .........?g........................H................Z..........T.......8...........T............=..!............%...........'..............................................................................eJ......x(......GenuineIntel............T.............?g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DB9.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.6973054201275812
Encrypted:	false
SSDEEP:	192:R6l7wVeJbN6lG6YdP6cwgmfxSBqprF89b8pGysfdA0m:R6lXJx6k6Yl6cwgmfxSBt8pGxfk
MD5:	68D0B2A1D55967FF97D0B284993D7C3E
SHA1:	C01E6A472CEA4DDF20401C0782B8A85B94814F7E
SHA-256:	5AFC3C791C355D4538F49D7BDBA37D6604A31EC2B43E9723A1D6CCCD473B553D
SHA-512:	C4DD5AD1225DF2CEED57343F57F1C8233F62FE7CC30B43277FA69EB639755CA8FD09CBEB594D8C62A76CED2F02A10E544A3809117A3382233132E4C2546B0E8D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DE8.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4656
Entropy (8bit):	4.471646983310799
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI961WpW8VYFYm8M4JFD0LBFs+q8x1o7mUyoE3aLd:uIjfoI7ME7VJJFQoeaByoEKLd
MD5:	C58D015B56D54816EE712C86DBFC482C
SHA1:	14F008978FB47C027FD1C74314FB66CE300F8034
SHA-256:	EE22C18764EA7D58FAA83B0FB3792073C66BB8B9A1527DD941B8F173F5B7D72E
SHA-512:	E8DA06EE1A5E117C99669C87C8584135558F8BE6C1167E1AA0F5BEEBC445FD9778A7E3A3169BB1786DB65D089A7A31B70E1AF99AD2DB5CD154FE5F67B42E4740
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="597689" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.905611951900379
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xNxl9Il8unOTC0X9kN5N3X/gdbESOixR9M7DHd/vc:azYBOTC0X49XiE2R9qO
MD5:	0D35A53AA2E18AF27ADC8EAE72433041
SHA1:	6F05D92C2341C2300EE5B350C5D2C1FF4D2CB4D0
SHA-256:	649307B2134D62BA2F0E763A1AC0D5B9010FC1F834F0BC0D66D649FB50699556
SHA-512:	F0198474B54A967391247AAF8267EC86BDDC25AF38AF789037D1AA51EF38D84C9A03432FB8FC90179044776E6BD4FCD9D7DA7F7FA2E1EFF5E540E694871C7AFC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.c./.u.a.9.F.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.o.i.5.t.m.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\json[1].json

Process:	C:\Users\user\task.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.015105568788186
Encrypted:	false
SSDEEP:	12:tkluQ+nd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qluQydRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	8937B63DC0B37E949F38E7874886D999
SHA1:	62FD17BF5A029DDD3A5CFB4F5FC9FE83A346FFFC
SHA-256:	AB2F31E4512913B1E7F7ACAB4B72D6E741C960D0A482F09EA6F9D96FED842A66
SHA-512:	077176C51DC10F155EE08326270C1FE3E6CF36C7ABA75611BDB3CCDA2526D6F0360DBC2FBF4A9963051F0F01658017389FD898980ACF7BB3B29B287F188EE7B9
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.75",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files.cab

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, many, 1458311 bytes, 6 files, at 0x2c +A "data.bin" +A "g2m.dll", ID 46085, number 1, 102 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1458311
Entropy (8bit):	7.999747988167558
Encrypted:	true
SSDEEP:	24576:MHVSY+M+2UC8yJ/ROwLcE8caCO1JgAt+lyp31XQnJfHtt4lj+u1BUTsFXk:9YJ+2/8yJ5OA4COg9lyp31X01clj+u1g
MD5:	240F5D10D0FDC6E3A73B6793E0EA260F
SHA1:	B6B7549B2C1A98FE88DEA9F9FB462CB203647DBC
SHA-256:	5AFA0071F63B662D93AB35E8A9A6A44B8AD439C62160388690E5E5793CB2B2D4
SHA-512:	FAA0654A4359A90338905BCF627CB75D10D277CE8E2AAFC07ECA75EA887F54750B118042DD1E25E45C02706791EA5F5741202309928140789C319988E05F5029
Malicious:	false
Preview:	MSCF.....@......,.......................f..............X.. .data.bin..l.........X.. .g2m.dll.F..........XF2 .run.bat.....:......XX\ .task.exe...........X9. .task22.msi..f....)....X.. .your_package_name.dll...K.....[....0......]'......`......Z.....v0...............~.......r(...V..#.5._.+.....PFvE..EiI.q....VzuWW....XK.R.?.r....y....e..y...K.v/t.`...k~V;LY....B..Q.cL...$.)`I......Yx..>..a..&uL.;.qIV.Av... ......2.^j.Gb....83s..X.m....:h..%8....;....@.P...x..$4..mV{G.....%..M.<..(.k...Z..\.\|:.=.x\|..#..=..L.d...k...C....xs}5..Z,.....Z....5...rv_......W..ns...L...f........eDYm.7.vF....K.lND...d.......z.CZ...t...J......^c..iX..u...iA..:P.mVX..J.ib./y.U.;.."^...;3.%t..g.Y.g.....T.....&...d..@.\?....c.-}....y...M..6..)._..."....d[.v....).d.w.C5...rg...[p..c.!.Q{...4s..#>.....1d.Xe#.E^E.<h....7......................`-.A.`.{%...3.$..{. ..&7d.)..#u..T..\|......).....4gG0..BSM..;&3;......3X.EZ.}0YG.NSp.7.t..Q.h.7...mxO...Zvs'js.2....;....G..8....+.}..H.,.K"9b

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\46024ecf2bfdea4bb37ae547628d1f53.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: GoToMeeting 5.4.0.1082, Subject: GoToMeeting, Author: Citrix Online, a division of Citrix Systems, Inc., Keywords: Installer, Template: x64;1033, Revision Number: {0477C971-7364-4C60-9D84-EFF0F290A852}, Create Time/Date: Thu Jan 11 14:59:38 2024, Last Saved Time/Date: Thu Jan 11 14:59:38 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	7.848370630711635
Encrypted:	false
SSDEEP:	24576:Ht9cpVDhqHVSY+M+2UC8yJ/ROwLcE8caCO1JgAt+lyp31CC:QpRhXYJ+2/8yJ5OA4COg9lyp31CC
MD5:	6406CCE810C8AAA887CA6B8E004776D2
SHA1:	1698D3D12341F3824E14F4DAE75300EEA9670797
SHA-256:	FBFDE6F43C30F454B07DBD2FDCD83685AE0016227F5489C13CCB510A0CFF00A6
SHA-512:	3CD6F24C1892ABD1B12A02DAC5AB53E2AFE1C68BC366D1DDB26DF1E56312DA7FF5CACA255E78CB61E3FCBBED21CD03FB8909C61302AF4DBCDDA7AD37EAC73FFA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\58f7e5e087b28e4e911e91b4d3b16d6e.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	data
Category:	dropped
Size (bytes):	759284
Entropy (8bit):	7.999779959160248
Encrypted:	true
SSDEEP:	12288:xHfeUm3mQ6v/drDVCNSVUzIq+0hplKC8yO1//jOwL1FXM8c4Pu0FxXmV1DU30ma8:xH+I1AMKUdC8yW/jOwLX88ctA41rmaQH
MD5:	8D9B3CA29D78CDA545CF0A3131536F17
SHA1:	D823975E67320244F3F02A59E5D29B53E16A828B
SHA-256:	97978EC89A58611CDEEFFC623805C91966BF1D861395082804EFE05302DAF7CD
SHA-512:	287799D662BF3F113AAB8009503AFE7306F489B7FDAD69CEFFB190C9757412E00F6D3EEDF5D5254D90319B27577D9567DC4B67860DC0148E249C042575F4DC0D
Malicious:	false
Preview:	`......Z.....v0...............~.......r(...V..#.5._.+.....PFvE..EiI.q....VzuWW....XK.R.?.r....y....e..y...K.v/t.`...k~V;LY....B..Q.cL...$.)`I......Yx..>..a..&uL.;.qIV.Av... ......2.^j.Gb....83s..X.m....:h..%8....;....@.P...x..$4..mV{G.....%..M.<..(.k...Z..\.\|:.=.x\|..#..=..L.d...k...C....xs}5..Z,.....Z....5...rv_......W..ns...L...f........eDYm.7.vF....K.lND...d.......z.CZ...t...J......^c..iX..u...iA..:P.mVX..J.ib./y.U.;.."^...;3.%t..g.Y.g.....T.....&...d..@.\?....c.-}....y...M..6..)._..."....d[.v....).d.w.C5...rg...[p..c.!.Q{...4s..#>.....1d.Xe#.E^E.<h....7......................`-.A.`.{%...3.$..{. ..&7d.)..#u..T..\|......).....4gG0..BSM..;&3;......3X.EZ.}0YG.NSp.7.t..Q.h.7...mxO...Zvs'js.2....;....G..8....+.}..H.,.K"9b.rB.D.F.%Eh...0...UU.c...m..#...u.9.aS...2. .\5q.?P....h..H.'.e..P.......#`:..%..>9.+...D.[.4U...&.td.......MMX..[.2.......T...3F.}...l.5C...9.y..:;m\:.B..'........T.. 2F.. *.I....q....p..B.++0.e?(.........v.A....w...C.z.

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\67a1ae3c4a36f34f89fd14e4fff5e74c.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40376
Entropy (8bit):	5.902054884820747
Encrypted:	false
SSDEEP:	768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
MD5:	F1B14F71252DE9AC763DBFBFBFC8C2DC
SHA1:	DCC2DCB26C1649887F1D5AE557A000B5FE34BB98
SHA-256:	796EA1D27ED5825E300C3C9505A87B2445886623235F3E41258DE90BA1604CD5
SHA-512:	636A32FB8A88A542783AA57FE047B6BCA47B2BD23B41B3902671C4E9036C6DBB97576BE27FD2395A988653E6B63714277873E077519B4A06CDC5F63D3C4224E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: FpiUD4nYpj.exe, Detection: malicious, Browse Filename: e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe, Detection: malicious, Browse Filename: 7Y18r(14).exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.1..._..._..._......._...^..._......._......._......._.Rich.._.........................PE..L.....P.....................\|............... ....@.................................-........................................!..P....P...t..........................0 ............................................... ..0............................text...5........................... ..`.rdata....... ......................@..@.data........0......................@....CRT.........@......................@..@.rsrc....t...P...v..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\75aedfde5bde214c9f1dda9d9e9a381f.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	617472
Entropy (8bit):	6.064860346549003
Encrypted:	false
SSDEEP:	12288:mwyPp3TItEKRC3YtYq0H+J6nEYpaM7Fd5ktc2/ZLvJ6Asu/uDc:mwggE2C3YtYq0eJgEYpaMnF2LvJ9/K
MD5:	FC284EEE599385A7AE9F098D123E983F
SHA1:	ACAA1C92D85AFD92184D49592AED3AEAB6AD2DED
SHA-256:	16414419A8248A4A55C05859C467D1FAFC298694F3F71916261FE2E08EBF4ABD
SHA-512:	C2538A98DE60AEDDB72CB14513ECCE3493F04E94135182AF658D3FC6425AD890560945EFB02C956B11AA10606C95E7CB286E73C0D27E71F2B17D3494506E7123
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D\.v..v..v...)..v.../."v......v.k./..v.k....v.k.)..v...+..v..v+..v.Z....v..v..v.Z...v.Z.(..v.Rich.v.................PE..L...Z=Bf.........."!...'.N...&...............`............................................@.........................p...........d............................P...G..@f..T....................f.......e..@............`...............................text....M.......N.................. ..`.rdata...e...`...f...R..............@..@.data....v.......l..................@....reloc...G...P...H...$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\87377860be1e204a95d069480a67ac12.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	615936
Entropy (8bit):	6.064847871237935
Encrypted:	false
SSDEEP:	12288:DMj1AFMhjwaqawEgg+V7yhlFPvqutOVNbdjhLAOENS7ZHMls:Yj1kjaqawEgg+VmhlFnquOrbLAOFZy
MD5:	8522CF224CB875847762353C89D2DCE2
SHA1:	4947EF0A7B3DA4972106A6A97FFF8C03F9DB6799
SHA-256:	3DC24E9A42D9230F4C0DB64BF11B9DF544066C80C49B2AA66CE9A01DDB8C4088
SHA-512:	8933F0ADD139FD10F452AD18BCC400AB288AEBE5BF764DA66EB332B9B97DC56F7AAAB66FD396B0CA1BF3C29A1487255B562A97FDEFFAACC142347A95CD503350
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|.........................r...........;j......;j......;j..........@....i...............i.......i......Rich............PE..L.....If.........."!...'.H...&...............`............................................@.................................`...d............................P...G...f..T....................f......@e..@............`...............................text....G.......H.................. ..`.rdata..>e...`...f...L..............@..@.data....v.......l..................@....reloc...G...P...H..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\775b62a938f64659aead6abedaf63071$dpx$.tmp\bce5c9c7fb0eb5498f5eb0ff4df1bd89.tmp

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.377806460743142
Encrypted:	false
SSDEEP:	3:mKDDFARE3BF//I+K9sALX:hmRACaALX
MD5:	F8ABF91D350D39FF1A48934B88624291
SHA1:	88EF29FD18441C628A43925A8B32535D39E07979
SHA-256:	5B4E3E3F739B1AE3CD907A0ABE9D5AAF51455551F69F9DA57E668F749584EFD6
SHA-512:	3C572C7415FBC8EE5F976AC9B6CCE43C901174777C859E9461451676BD5158E940E0BD173D83D980958295CB9DAACC489F0D596D98E93F71CB81D2603F037876
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..setlocal..cd /d "%~dp0"..start /B "" "task.exe"..endlocal..

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\data.bin (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	data
Category:	dropped
Size (bytes):	759284
Entropy (8bit):	7.999779959160248
Encrypted:	true
SSDEEP:	12288:xHfeUm3mQ6v/drDVCNSVUzIq+0hplKC8yO1//jOwL1FXM8c4Pu0FxXmV1DU30ma8:xH+I1AMKUdC8yW/jOwLX88ctA41rmaQH
MD5:	8D9B3CA29D78CDA545CF0A3131536F17
SHA1:	D823975E67320244F3F02A59E5D29B53E16A828B
SHA-256:	97978EC89A58611CDEEFFC623805C91966BF1D861395082804EFE05302DAF7CD
SHA-512:	287799D662BF3F113AAB8009503AFE7306F489B7FDAD69CEFFB190C9757412E00F6D3EEDF5D5254D90319B27577D9567DC4B67860DC0148E249C042575F4DC0D
Malicious:	false
Preview:	`......Z.....v0...............~.......r(...V..#.5._.+.....PFvE..EiI.q....VzuWW....XK.R.?.r....y....e..y...K.v/t.`...k~V;LY....B..Q.cL...$.)`I......Yx..>..a..&uL.;.qIV.Av... ......2.^j.Gb....83s..X.m....:h..%8....;....@.P...x..$4..mV{G.....%..M.<..(.k...Z..\.\|:.=.x\|..#..=..L.d...k...C....xs}5..Z,.....Z....5...rv_......W..ns...L...f........eDYm.7.vF....K.lND...d.......z.CZ...t...J......^c..iX..u...iA..:P.mVX..J.ib./y.U.;.."^...;3.%t..g.Y.g.....T.....&...d..@.\?....c.-}....y...M..6..)._..."....d[.v....).d.w.C5...rg...[p..c.!.Q{...4s..#>.....1d.Xe#.E^E.<h....7......................`-.A.`.{%...3.$..{. ..&7d.)..#u..T..\|......).....4gG0..BSM..;&3;......3X.EZ.}0YG.NSp.7.t..Q.h.7...mxO...Zvs'js.2....;....G..8....+.}..H.,.K"9b.rB.D.F.%Eh...0...UU.c...m..#...u.9.aS...2. .\5q.?P....h..H.'.e..P.......#`:..%..>9.+...D.[.4U...&.td.......MMX..[.2.......T...3F.}...l.5C...9.y..:;m\:.B..'........T.. 2F.. *.I....q....p..B.++0.e?(.........v.A....w...C.z.

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\g2m.dll (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	617472
Entropy (8bit):	6.064860346549003
Encrypted:	false
SSDEEP:	12288:mwyPp3TItEKRC3YtYq0H+J6nEYpaM7Fd5ktc2/ZLvJ6Asu/uDc:mwggE2C3YtYq0eJgEYpaMnF2LvJ9/K
MD5:	FC284EEE599385A7AE9F098D123E983F
SHA1:	ACAA1C92D85AFD92184D49592AED3AEAB6AD2DED
SHA-256:	16414419A8248A4A55C05859C467D1FAFC298694F3F71916261FE2E08EBF4ABD
SHA-512:	C2538A98DE60AEDDB72CB14513ECCE3493F04E94135182AF658D3FC6425AD890560945EFB02C956B11AA10606C95E7CB286E73C0D27E71F2B17D3494506E7123
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D\.v..v..v...)..v.../."v......v.k./..v.k....v.k.)..v...+..v..v+..v.Z....v..v..v.Z...v.Z.(..v.Rich.v.................PE..L...Z=Bf.........."!...'.N...&...............`............................................@.........................p...........d............................P...G..@f..T....................f.......e..@............`...............................text....M.......N.................. ..`.rdata...e...`...f...R..............@..@.data....v.......l..................@....reloc...G...P...H...$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\run.bat (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.377806460743142
Encrypted:	false
SSDEEP:	3:mKDDFARE3BF//I+K9sALX:hmRACaALX
MD5:	F8ABF91D350D39FF1A48934B88624291
SHA1:	88EF29FD18441C628A43925A8B32535D39E07979
SHA-256:	5B4E3E3F739B1AE3CD907A0ABE9D5AAF51455551F69F9DA57E668F749584EFD6
SHA-512:	3C572C7415FBC8EE5F976AC9B6CCE43C901174777C859E9461451676BD5158E940E0BD173D83D980958295CB9DAACC489F0D596D98E93F71CB81D2603F037876
Malicious:	false
Preview:	@echo off..setlocal..cd /d "%~dp0"..start /B "" "task.exe"..endlocal..

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40376
Entropy (8bit):	5.902054884820747
Encrypted:	false
SSDEEP:	768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
MD5:	F1B14F71252DE9AC763DBFBFBFC8C2DC
SHA1:	DCC2DCB26C1649887F1D5AE557A000B5FE34BB98
SHA-256:	796EA1D27ED5825E300C3C9505A87B2445886623235F3E41258DE90BA1604CD5
SHA-512:	636A32FB8A88A542783AA57FE047B6BCA47B2BD23B41B3902671C4E9036C6DBB97576BE27FD2395A988653E6B63714277873E077519B4A06CDC5F63D3C4224E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.1..._..._..._......._...^..._......._......._......._.Rich.._.........................PE..L.....P.....................\|............... ....@.................................-........................................!..P....P...t..........................0 ............................................... ..0............................text...5........................... ..`.rdata....... ......................@..@.data........0......................@....CRT.........@......................@..@.rsrc....t...P...v..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task22.msi (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: GoToMeeting 5.4.0.1082, Subject: GoToMeeting, Author: Citrix Online, a division of Citrix Systems, Inc., Keywords: Installer, Template: x64;1033, Revision Number: {0477C971-7364-4C60-9D84-EFF0F290A852}, Create Time/Date: Thu Jan 11 14:59:38 2024, Last Saved Time/Date: Thu Jan 11 14:59:38 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	7.848370630711635
Encrypted:	false
SSDEEP:	24576:Ht9cpVDhqHVSY+M+2UC8yJ/ROwLcE8caCO1JgAt+lyp31CC:QpRhXYJ+2/8yJ5OA4COg9lyp31CC
MD5:	6406CCE810C8AAA887CA6B8E004776D2
SHA1:	1698D3D12341F3824E14F4DAE75300EEA9670797
SHA-256:	FBFDE6F43C30F454B07DBD2FDCD83685AE0016227F5489C13CCB510A0CFF00A6
SHA-512:	3CD6F24C1892ABD1B12A02DAC5AB53E2AFE1C68BC366D1DDB26DF1E56312DA7FF5CACA255E78CB61E3FCBBED21CD03FB8909C61302AF4DBCDDA7AD37EAC73FFA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\your_package_name.dll (copy)

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	615936
Entropy (8bit):	6.064847871237935
Encrypted:	false
SSDEEP:	12288:DMj1AFMhjwaqawEgg+V7yhlFPvqutOVNbdjhLAOENS7ZHMls:Yj1kjaqawEgg+VmhlFnquOrbLAOFZy
MD5:	8522CF224CB875847762353C89D2DCE2
SHA1:	4947EF0A7B3DA4972106A6A97FFF8C03F9DB6799
SHA-256:	3DC24E9A42D9230F4C0DB64BF11B9DF544066C80C49B2AA66CE9A01DDB8C4088
SHA-512:	8933F0ADD139FD10F452AD18BCC400AB288AEBE5BF764DA66EB332B9B97DC56F7AAAB66FD396B0CA1BF3C29A1487255B562A97FDEFFAACC142347A95CD503350
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|.........................r...........;j......;j......;j..........@....i...............i.......i......Rich............PE..L.....If.........."!...'.H...&...............`............................................@.................................`...d............................P...G...f..T....................f......@e..@............`...............................text....G.......H.................. ..`.rdata..>e...`...f...L..............@..@.data....v.......l..................@....reloc...G...P...H..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\msiwrapper.ini

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1458
Entropy (8bit):	3.6672578438154977
Encrypted:	false
SSDEEP:	24:zoEwUodX8DW8XjULX1+GukdrFF4YI9Y4YI9Nyq4YI9v5Ru9:zZwrYaukhFF4YN4Yuv4YN9
MD5:	419617EE7641A991D2B1DD3144248EF7
SHA1:	7C91BB20A4106692332E853E0038D179BEBBE64F
SHA-256:	C017A94813B6243388EAF8D37F93264DE1D50BE77802921289D06ED8630BC346
SHA-512:	37020EB9FCFD2C07DE77DCCCC31DECE61734DC5A705F1C4202AE822B4820C62884269844913925036EF055F4B09D67E6E64B2107721055EF5D98381AED2988F8
Malicious:	false
Preview:	W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=.7.-.Z.i.p.\|.B.r.a.v.e.S.o.f.t.w.a.r.e. .B.r.a.v.e.-.B.r.o.w.s.e.r...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.H.i.d.d.e.n...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.n.e.v.e.r...B.a.s.e.N.a.m.e.=.t.a.s.k...e.x.e...C.a.b.H.a.s.h.=.5.a.f.a.0.0.7.1.f.6.3.b.6.6.2.d.9.3.a.b.3.5.e.8.a.9.a.6.a.4.4.b.8.a.d.4.3.9.c.6.2.1.6.0.3.8.8.6.9.0.e.5.e.5.7.9.3.c.b.2.b.2.d.4...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=..F.I.L.E.S.D.I.R....U.I.L.e.v.e.l.=.5...F.o.c.u.s.=.y.e.s...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.7.0.3.9.4.d.6.c.-.f.5.1.f.-.4.7.2.d.-.a.6.f.7.-.9.1.5.6.5.4.c.f.9.b.1.e.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.7.0.3.9.4.d.6.c.-.f.5.1.f.-.4.7.2.d.-.a.6.f.7.-.9.1.5.6.5.4.c.f.9.b.1.e.\.f.i.l.e.s.\...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.F.i.l.e.=...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.P.a.

C:\Users\user\AppData\Local\Temp\bhvAED7.tmp

Process:	C:\Users\user\task.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x53c051b8, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	16252928
Entropy (8bit):	0.9688562385717057
Encrypted:	false
SSDEEP:	6144:IoTz5eo1CKGP5q/XiE9ENP//Xsx0BnNP//Xsx0Bn695nu8eX8e58ekpjX8ev8efS:Ih+NFrVo90FdLhVKsKan19
MD5:	6BD1EDC3FC67AB10B5817EC905A47263
SHA1:	C3C64EDC4B0C1BB8248E038FBBFB283996F40966
SHA-256:	AAFE33B8082214A1EED78AE8F4A32DBF3A232BE4512FEF0EE90A79AF00837C73
SHA-512:	1F74EBAFF67916D79D322B66F521F2302E4AAE24F41A9E7DB5C67F4578A3A32B4DE9DA856EA55871A6276B4713A09FB8D12B1D121F512C03EC937C8C1EA4E472
Malicious:	false
Preview:	S.Q.... .......4........X.2';...{k.......................k..........{..5....\|..h.m............................';...{-.............................................................................................S...........eJ......n........................................................................................................... ............{E..................................................................................................................................................................................................{E.....................................5....\|..................AF.;5....\|...........................#......h.m.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\09084311-6101-4307-8042-692387250400.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4198
Entropy (8bit):	5.483165048243419
Encrypted:	false
SSDEEP:	96:0q8NkGS1fuxv6C58rh/cI9URoDotorujBauvqvV2JkCc1aSDS4S4SDSmI4a:/8NBSkaeoDUh9mVikCwR
MD5:	081215CC735B1BD922A04B1FF884AA43
SHA1:	ABA81F23F307A5AB74C2B2C6D94119F06EFC889D
SHA-256:	8920FC9A2BF08C6F350B83D47F9697061D2EFFCEA2604029AF7FDF5F88A05C40
SHA-512:	2DDBB384EC794C59171715A042BCB0A7BE54EF9CE1206FFCF5237318D5F453BF9941866F13BF7D108D9CEDD425F8533BB0D2DB03C0BEBD41DF0758F6D37866BD
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzve

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\40467ba0-1653-4c89-85b8-2b44867f47f0.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3282
Entropy (8bit):	5.588111273444896
Encrypted:	false
SSDEEP:	96:0q8NkC1fuxv6CeHBauvqvV2JkCc1aSDS4S4SDSmI4a:/8NbkimVikCwR
MD5:	43ED9F7B4B26E986E54D5D067D056CF7
SHA1:	FFA37C0174EA68D6191C05B416E7FEC577E33996
SHA-256:	1242466F0FB5EFE3382DEF81E4A08193F45892FDFAD770B926EAA205A89A4B17
SHA-512:	6917CC8AA0E37D1069294AB81C37F950D64E63F9D6442E1E6BD31BE2E3B13CDBDDB91057A46419EC6B0F07F38987C416CD5711402152435203079E88BF986A77
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzveK0Jng=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\BrowserMetrics\BrowserMetrics-673F0B08-1074.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 33554432.000000, slope 293373858522878600971173199085568.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.22190570136812404
Encrypted:	false
SSDEEP:	1536:OmJO+i7tYUiQUkR7iRGaIFfcRGg1DRFFbqyRG4bpYi3zFH:OmA+wtYnQp9LaIFfpg1HFbq7kp1zF
MD5:	96CC566EBCA09C0AAAD45C6727E9AE15
SHA1:	35D6E3649A2AE249FD35D5E93EEFAB7189877190
SHA-256:	6099CEB2BC18E1354BD83A5050960E82B305D7F02B789D3605CC56C00851AB32
SHA-512:	002ACEB0AC836D857FA547F51A47C507AC46BF77F45F869D28FB51820F74B73F4FCE4825C572173C7941037E49D2C05A38FFE0C5A60E99F5BFE1159826E045DD
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".axwgwm20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............;........................<.w..U..d.y.oK.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...h..\|?.T@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered...

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7743147021878358
Encrypted:	false
SSDEEP:	3:FiWWltlxVLVH+aQ/XlQTMUaitIdmW89G/:o1jLVH+BXWofuIIW89
MD5:	3EA201AEF287EBF973E1A12BFE5F5C51
SHA1:	EAFB1D1BE3560ABF539E145CF6DF2C399964D605
SHA-256:	C075F48214230427DBA7B750D520BED4C1AF506FA5E6F1A90D741F3F9FFCFCB3
SHA-512:	8351348611B1148B3C7FD742FD6C706BDCA10C1E7F0D35DD03D48DAA883E82682B48D56E23B09DDACAC27A8BEDC90E0679183E0106C90B3064D967952BCA6561
Malicious:	false
Preview:	sdPC.....................!....B...)....................................................................................................................................................................................................1d6028a1-60eb-480a-a77a-a923f6a0f623............

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Crashpad\throttle_store.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\1d0e1950-c91c-4fdd-afd6-8af39cfd64c4.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Cache\Cache_Data\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.012699554836657426
Encrypted:	false
SSDEEP:	3:MsFlYhEtlGJllXEagKlErKlnl//1g6q/l:/FiEXGll5ln/O
MD5:	AB91D3B7BD95B6696992F6EAEB807D47
SHA1:	B2043CEFBEF3539C2FA046BFF4EA36A9D6A56AAA
SHA-256:	496235D6701BD37CD70AC93BD5C9292C4C2060F722C65502FB9FB687BED47ECF
SHA-512:	B9443D2B5153A491D873A18586AA1E78EFCCAC9BE0F019160D4A3C01282201529F9CD4EEA0463D2956493620DB1AF8C5D5927BA954F4259785E6FC9FE51AAA2D
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Cache\Cache_Data\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.028947412170811843
Encrypted:	false
SSDEEP:	12:U/BEbtMFwGzwcdCIRrYfhbtZPC93OHjsqJm09MWPG:qUtMFwGzTd/Rc1PCQHjTpM
MD5:	1266DCB65D6BDA2AAD513390AA95CA09
SHA1:	F5884EFA6A3527D1513F3C6BEBB1758EC9F72C80
SHA-256:	AA320E1E76EF58E00943718AB13471F387D24AC1A48673F0FE976407455EE96A
SHA-512:	72F189FD6A6E2F414B5A041E1E9F9684BAFC8476B0EC373EA4EC5E5C89A12DA26937FA5945E835793CB9F732B0EE50E9E5D0D9460E846D7C3E13F3BD1FEE7D48
Malicious:	false
Preview:	................................................................................s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Cache\Cache_Data\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Cache\Cache_Data\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Cache\Cache_Data\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsuldj//:LswX
MD5:	E26E6BE7D8C8B23CE4203F25D79433A8
SHA1:	9DC2B2751CD7A5D8F8C633A1AB2216852925E707
SHA-256:	06DB5E5A496EB20ADFC147042A98134E56DB48C0B80929E4C9A749C35169CAB8
SHA-512:	BF841F7E89561C94A1428E210C3524D70D746865FBF49096E04553990A4613260928CBE1D30F6D2D3BB290A3AFEFDE7F96A3AFE25EE175865DBC65BCBFBFC9FB
Malicious:	false
Preview:	........................................v...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\js\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:pfdSyEfKj6n:2fKj6
MD5:	F7F504BC76D7F404570E8E7EF1D7CF51
SHA1:	22E9973F3F4012E084D6A0985A518A6DF8E88650
SHA-256:	DC14EC6513A853EEA891CCDDE2EEB1FDB0B578DB281383B6CD25CFD1E2505872
SHA-512:	5876BF590AB57A7D7227E70C6ACAF91DEB4C0B4A11DD04F91AFAE86BD378F33AED9514A02128F6E34FF3C683A05322AD986302167FF76D0B22AB2B246A3AF7A0
Malicious:	false
Preview:	(...4zL.oy retne............................./.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:pfdSyEfKj6n:2fKj6
MD5:	F7F504BC76D7F404570E8E7EF1D7CF51
SHA1:	22E9973F3F4012E084D6A0985A518A6DF8E88650
SHA-256:	DC14EC6513A853EEA891CCDDE2EEB1FDB0B578DB281383B6CD25CFD1E2505872
SHA-512:	5876BF590AB57A7D7227E70C6ACAF91DEB4C0B4A11DD04F91AFAE86BD378F33AED9514A02128F6E34FF3C683A05322AD986302167FF76D0B22AB2B246A3AF7A0
Malicious:	false
Preview:	(...4zL.oy retne............................./.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\wasm\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\wasm\index-dir\temp-index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Y+lXAyEO8G:YOQ9tG
MD5:	11AA5D04A8BF797CF732B80DD888D137
SHA1:	D452A548D92DAEA8E15133D33AAE4D10D39EAEA0
SHA-256:	88ED9F254AD70B720116BEE6C28883BA6C04B42AB078F45C371D9393A068260F
SHA-512:	5B3CA85B36E40E2750D0A6401DF58A70A1A8BA5CE076144F58FCA5EB68C9C6D875E3CDBE1C27C0AA7B855887753A0CEB1C1387DD95EDDC3DB2AA5DD430C627E1
Malicious:	false
Preview:	(....[..oy retne............................../.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Y+lXAyEO8G:YOQ9tG
MD5:	11AA5D04A8BF797CF732B80DD888D137
SHA1:	D452A548D92DAEA8E15133D33AAE4D10D39EAEA0
SHA-256:	88ED9F254AD70B720116BEE6C28883BA6C04B42AB078F45C371D9393A068260F
SHA-512:	5B3CA85B36E40E2750D0A6401DF58A70A1A8BA5CE076144F58FCA5EB68C9C6D875E3CDBE1C27C0AA7B855887753A0CEB1C1387DD95EDDC3DB2AA5DD430C627E1
Malicious:	false
Preview:	(....[..oy retne............................../.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\DawnCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\DawnCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\DawnCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\DawnCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\DawnCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlDRG//:Ls3Nm
MD5:	B948FAA26724507AB3B80B88081C082A
SHA1:	CD258E7331F32E5AA7C46214F261DDCEF4444380
SHA-256:	2804935E771F9A47DDDCD0C6A7735BC933639C5D42273DA6BD88CB74C8413A1C
SHA-512:	C7B73FC4DA10595F47AEE39221B1660CE897F5E9829204AA7FC488F73A727956CDAA2BAEAD641C9705B49AA54F9ED3CB6CFBF192B6C307A192E19BF5075369C5
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons\coupons_data.db\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons\coupons_data.db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.272113637469218
Encrypted:	false
SSDEEP:	6:HEFS/lB1qLTwi23fQr//G2tbB2KLlVEFSyNFN+q2PqLTwi23fQr//G2tMsIFUv:ko/WwZCn9VFLsoyNOv8wZCn9GFUv
MD5:	EBFF4D683DE99C2E013E4C4DFA855C8C
SHA1:	EB330CB118496E821E2129F41592BCCFCF74DE6D
SHA-256:	2473256D294FF22356E457AD9F8D5FC21ED14FBB4E724D0132769255D64ABBD5
SHA-512:	3A4AEE393A4647BD6BEFF846FAE2DCC96A1923B4906B2B5DF65057839DD7203FC1E99421ABA5F54425C29E0BB4E0A883314B574E36360AF4E3C067955E56D5E1
Malicious:	false
Preview:	2024/11/21-05:27:21.041 1928 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons/coupons_data.db since it was missing..2024/11/21-05:27:21.150 1928 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.241327403303907
Encrypted:	false
SSDEEP:	6:HEFSIq1qLTwi23fQr/UaVdg2KLlVEFSqN+q2PqLTwi23fQr/UaPrqIFUv:koIfwZC0LsoqIv8wZCL3FUv
MD5:	57940239E2CFDDBE813C0994EC2508AB
SHA1:	05F432F4796BA7FE004BEC385344AA0E3EE6FCB6
SHA-256:	8C48F0EEDB9EF4C59FB37CAF08AC1122F7A3647E8EB36D6474C76B3AC5274688
SHA-512:	293E70D8781A6B54A19B2714B77B34726214429EDD61116D9D7C284877FE06B645A7E32035EC5F4DF0D734075CCBD7C792117225BAE4AC7A95F42537551DBC91
Malicious:	false
Preview:	2024/11/21-05:27:21.039 a88 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules since it was missing..2024/11/21-05:27:21.166 a88 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Rules\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	5.214891963289152
Encrypted:	false
SSDEEP:	6:HEFSFM+q1qLTwi23fQr/U6FB2KLlVEFSk+q2PqLTwi23fQr/U65IFUv:koFM+fwZC/FFLso5v8wZC/WFUv
MD5:	FF51BAAA50BCA2CB187F186264631436
SHA1:	D0B6777A7AB18282C207C2F4715292A3DA1B2AED
SHA-256:	CF112ABF47F179A1431BDE578797E2A83D5620797135B0EF566DBA1D5F023E64
SHA-512:	8105E2C2AD6E86C8454AD1BC3241C5E3F2FC6140AE097A59CB378B2EC9294C0909B0F0E93C378962255833C55A6C558634EDD7221D1BAEDB341F8BCEDFA61678
Malicious:	false
Preview:	2024/11/21-05:27:21.254 a88 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts since it was missing..2024/11/21-05:27:21.313 a88 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Extension Scripts\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Favicons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\GPUCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\GPUCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\GPUCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\GPUCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\GPUCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlo//:Ls3o
MD5:	F110E320E08EB43276136574077E2420
SHA1:	62D89145F2D8C91818CDD953CD32546BE1877179
SHA-256:	D2582808DC6C18904FA17C12EF6AA7D7D2B0973430E5BEA20D3DD203E75BA5D7
SHA-512:	B2D05CF7AB2183322DDCE234A752F059D64D46B92782D0C323C9B72F8688D8013592FC6E12A1D7C01640791AACF5243A68E804A6A96C9F66881DA7E1F1D2DFCD
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\History

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\HubApps Icons

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.280718689372398
Encrypted:	false
SSDEEP:	6:HEFStAAB1qLTwi23fQr/0a2jM8B2KLlVEFSQUXN+q2PqLTwi23fQr/0a2jMGIFUv:kotAAowZC8jFLsoQRv8wZC8EFUv
MD5:	48EF090AEB4C6900922CD7F4A20BED0D
SHA1:	A590F7DC379A13166E83C629D91273BCFAE55689
SHA-256:	362D50404EFAAD719E82DA14A836553793EB9FE66878FD2F81B2415436F31D63
SHA-512:	CF511DD6D4D544C302BFF379DFF56C457A228B4F4A964136277D4DEE72E932321B2482D1E7EF973B0F15D569E1BFFFEB40DB14EB1426D13AC03C5A866062C954
Malicious:	false
Preview:	2024/11/21-05:27:21.396 12b8 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb since it was missing..2024/11/21-05:27:21.529 12b8 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Local Storage\leveldb\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Login Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\61923a97-38bf-4031-88d2-1b7fb3bb403a.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\Cookies

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\Reporting and NEL

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3237637357343357
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8T/l5qKZwkvAngLusiOImWtz0vlWmW8QeZa5qguxtqlyup6YZ75fOV:TLiuWkYl0KONFxOUwa5qguWfpbZ75fOV
MD5:	3EF849ABC9E84C1D19566A9128442C47
SHA1:	E9C70A5823A7A46330A18D51A4413ECFDAF10753
SHA-256:	301CD0F39EB7BBFA37303A5D482614B67A78979F5D761520EDFB16C4BA77EE92
SHA-512:	DFD248A745C1960BFB792FC59F90724DD937D5D431F28E1F6CCBC0F55E551B0818408AD353B88DC83439AF2D7B249C9576B1F1F66838B59865EA9F5644CC9EBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......g..g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\Reporting and NEL-journal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.49635072460257995
Encrypted:	false
SSDEEP:	6:blgPg9bNFlEuWk8T/l5qKZwkvAngLusiOImWtz0vlWmW8QeZag2:bl4qLiuWkYl0KONFxOUwaV
MD5:	6088AB04C8224CACBFBD9C37421B4D6B
SHA1:	86C85388A9965B16B2E123592F05D29B3D87502C
SHA-256:	E0ED3591992E6B81082C97595407D4BAAC82E560A0B3DF17A413BBE139F0EEEA
SHA-512:	08E19800E501963B3F96732BE25AFDDD650A6295873487AD53F23DC125ABEDE5B0525BEDFF20807366CBF34C00E7CD5C188DD179CC7F31524D765E90CA358F98
Malicious:	false
Preview:	.............Z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.......g..g......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\SCT Auditing Pending Reports (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\SCT Auditing Pending Reports~RF2e67e.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\Trust Tokens

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Network\fb567f2b-288f-4830-8540-4dccbaa7249d.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\README

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	5.194855178635482
Encrypted:	false
SSDEEP:	6:HEFS2s1qLTwi23fQr/DQM72KLlVEFSEFKn+q2PqLTwi23fQr/DQMxIFUv:ko2FwZC/LsoEF/v8wZCCFUv
MD5:	6934DFD99E4BB8E0DFEEA0F40821919C
SHA1:	834F22DD97A8806664ED6DEA011851E63F8ED5D8
SHA-256:	3FCD11A0B7923D51531DFA4019A7873CBE9083A7ED030676CDBB6B9ED3478603
SHA-512:	946391CF3079897DF41FFB289313736FF2E75142D3AE31CEC239A45EFD71D8184DB1218B16E6C8795BBDCAB744D511A83F9D6E294688704491CF94375946B4AB
Malicious:	false
Preview:	2024/11/21-05:27:21.714 1608 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage since it was missing..2024/11/21-05:27:21.763 1608 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Session Storage\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.044488801382113
Encrypted:	false
SSDEEP:	6:HEFSQXs1qLTwi23fQr/TUh2gr52KLlVEFSRnM+q2PqLTwi23fQr/TUh2ghZIFUv:koCFwZCIhHJLsoRM+v8wZCIhHh2FUv
MD5:	3BC5F6ED6DD397EBAA82220D2BB5465B
SHA1:	2688D44339C4F52A01BDB3AE2F18D16A2105329D
SHA-256:	2E37313374DC85D2A23B5E4C2DEE81D316318EE2BFAFC11204C62C9DE15F21A4
SHA-512:	09C3468D72E4CFB95D164391510D25B22BFE736FB4CC3EF06A6224233091DE00782E080405E28D9E93CC949FB93A330227C0B9A81BCC31CA655C0EB1DDAD27D9
Malicious:	false
Preview:	2024/11/21-05:27:21.041 1e1c Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database since it was missing..2024/11/21-05:27:21.222 1e1c Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Site Characteristics Database\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	265
Entropy (8bit):	5.197944585609627
Encrypted:	false
SSDEEP:	6:HEFSMI81qLTwi23fQr/Zx2KLlVEFSX+q2PqLTwi23fQr/RIFUv:kopVwZCBVLsoX+v8wZCmFUv
MD5:	15A3F600FD984C22762C1A6125914483
SHA1:	41F2B9F7BADF38E5735C27E37027A1FC15A30D5F
SHA-256:	B6F158498D492CC120F11C3879320FCCBF3157A04661E07DE787B3F66EBEF197
SHA-512:	0B651B4579D6501CCF17F92BB2BC10BCB2ED692F4E298A292668F52E7A44A15EF5BFBE4F46BE611BECEE9141984F2C08649171A74832AD08A66FF098B8FFE3B0
Malicious:	false
Preview:	2024/11/21-05:27:21.102 1dcc Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB since it was missing..2024/11/21-05:27:21.130 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Sync Data\LevelDB\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Top Sites

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Visited Links

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtVSstl:IiVSk
MD5:	319655F3A91BE555AB83426E35998502
SHA1:	41B4DCB192A115F52F44646DEAADC958FF2F8570
SHA-256:	78E3F4BE4A5419D35A16F87276687DAE95404C4D77443E88107B797BA97802C8
SHA-512:	EAE30ACA6321B2D5799DB71E078F4E5D687B384FAC8A5206E1CD1387B6029D5DFB1A806C00F3D62412D0E287EF536E0A5AC416CF3329613DED90D9168F5BF0D9
Malicious:	false
Preview:	VLnk.....?.........`(L..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Web Data

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9401384989520177
Encrypted:	false
SSDEEP:	192:Qrb2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:Q/2qOB1nxCkvSAELyKOMq+c
MD5:	6817EEA7CE56E1AB1ECF93C090727E0F
SHA1:	49A10B3D157FB49768284F68335CC7B378FB13B4
SHA-256:	FF7B98237D2FA7537470A573B9FD12D9C656EDACC0949AA12B75970528F650CD
SHA-512:	6E14A0B0A47B493493F6C0C8C2A15028C0C1D53E247D1FB2D227DC772ACFB6ADF2B74CBC8FB223156A1D39A1295FFF7EC054E9BE51DBF7BCE61CC597510C4EAE
Malicious:	false
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\Web Data-journal

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:s/El1lOtlu:s/E7
MD5:	E94343720FFDE90DF8BEB182292098F0
SHA1:	8A33CE84D2D7C920B12C3B4FB290AF717711D40F
SHA-256:	F764DCFAFF816B41E15C18E218BA0F3BCA8E0B6072320161E85A31DA7DBCD710
SHA-512:	6B3879EC686E904BDD3A1DFBA928751B1665365666C8D52F04C8FB1CD54F0D729E85C6DE30A4343307D629F7871FF60A62602E450AFB31755D30BB8B481F3A1E
Malicious:	false
Preview:	............dJ.3...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\arbitration_service_config.json

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3852), with CRLF line terminators
Category:	dropped
Size (bytes):	11417
Entropy (8bit):	5.237554345326078
Encrypted:	false
SSDEEP:	192:dH4vrmORnBtW4PoiUDNaxvR5FCHFcoaSbqGEDu:dH4vrmonPW4jR3GaSbqGEDu
MD5:	DF790948C5A7B5DD19D033FE6C793868
SHA1:	0C4A681E07505CA84997CE78FEEE1F0D88CB8E2A
SHA-256:	CB4049061A6A78013D20CC4AB396BEF4F6C35306887BE76765EED4E51EEE702D
SHA-512:	251C3B5DE5452E2F40C648BDB2E3D1CE2315DD4DFFAF4B4E5E08528DBAAB80535F1A82E183A65AB7DCA0C2926AE5D6B61F06DB390D0E3B8D8E77E826B21042CB
Malicious:	false
Preview:	{.. "ArbitrationSignal": "(time_elapsed_since_last_notification)-3600^(notification_quick_dismiss_rate_lower_ci+notification_disable_rate+notification_snooze_rate)",.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f41

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\b41b11d1-833a-41cd-aeef-18d0b252f4d3.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	5.284425935411061
Encrypted:	false
SSDEEP:	6:HEFSlAEq1qLTwi23fQr/Hrl2KLlVEFSmJN9+q2PqLTwi23fQr/HrK+IFUv:koPfwZC1LsomJOv8wZC23FUv
MD5:	75919257B38AA1AC7554A3776E0F9541
SHA1:	9C39A60296A26221C376F212A6C9C66577C166A2
SHA-256:	05EED9C8911E49C5E414A0243B0BFCDBA2F4C0255FFEB8DB215A091A690612D7
SHA-512:	1EFD96326D8656989FFC76B96F96E824C704431A8E48695370BB5F9E34B6AA681ADE8DC144390902B625E24AC9C708F31A65A25A5C6FC3E86E33A018F729172C
Malicious:	false
Preview:	2024/11/21-05:27:22.019 1d88 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db since it was missing..2024/11/21-05:27:22.042 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata\000001.dbtmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata\000003.log

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.7064843374216494
Encrypted:	false
SSDEEP:	3:G0XttkJcsRwI9tkJcsIap3mEaXe/tlfmo1cgtfmEbQJkZt/fmoG:G0XtqcsqcpS3m9XOPmQ1mdkZt3mh
MD5:	B35D474DF6A64D3841ECDF798DBE93FF
SHA1:	DD4C3D2FDC5997B6DF5FB619420125F8D12D5449
SHA-256:	924C5DED0B3D90B90AE8D7EC72CF1FCBEDF69402A2DF3302E462495D47D6BD1D
SHA-512:	C4CFAEFB6DC71762ABEB055240B9D64F7EC573BA0FD165277DEF2658B8D605B78EEEE37092840731AA687CEFEF55341595A08CBD3871E32D02182F8EFE82159F
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..'i..................21_.....B....................33_......-.t.................21_......'..................33_.....

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata\CURRENT (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata\LOG

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.257615727799289
Encrypted:	false
SSDEEP:	6:HEFS1jAEq1qLTwi23fQr/Hrzs52KLlVEFSvdX9+q2PqLTwi23fQr/HrzAdIFUv:ko1VfwZCs9LsoOv8wZC9FUv
MD5:	FFA578AFBE829BB717633BB6F135AA4E
SHA1:	8ADB0FCA31C24F578A23F10467EBF230D4525C28
SHA-256:	4C005C5C7728A811CB5CA5000FA39C89305B26058FBC44F0D4A556DB861EAEC0
SHA-512:	6A79E3CE2D0D6BD305844487BDD4BC3C69C44DA9E778BAEDDAA028A2733C564B37D4EF5C1B106330EC820B5CF945588689815C63D989FD137A2BF1BFE37F904F
Malicious:	false
Preview:	2024/11/21-05:27:21.993 1d88 Creating DB C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata since it was missing..2024/11/21-05:27:22.016 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Default\shared_proto_db\metadata\MANIFEST-000001

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Last Version

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5443902513238
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1+/emJFyX8x9WwgyikOJdXmuBuwBwja9IENhlA+X7QQRCYfYg:YuBqDPafuJM8vmZRBzB4iIelA+EB0
MD5:	385BE2D3EAEE8D782BB104CBC41056E5
SHA1:	513716501759B5EC3ECAC0E60662E8F59F708AB4
SHA-256:	1C4DE1B12E00DEE53ECD26D2C8F18BB2C17A5E4403A30F6A0A24834CF3321388
SHA-512:	847306E2F352B18F14D586A893872EF8E3BDAAD016A15274C832DBF8D907154975F2816B5BDD9138E2C131F1920C2E9A8080E51F788DEB2AA30CD753D4FEF4E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzveK0Jng=="},"profile":{"info_cache":{},"profile_counts_reported":"13376658440579494","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1732184840"},"user_experien

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Local State~RF2e17c.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5443902513238
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1+/emJFyX8x9WwgyikOJdXmuBuwBwja9IENhlA+X7QQRCYfYg:YuBqDPafuJM8vmZRBzB4iIelA+EB0
MD5:	385BE2D3EAEE8D782BB104CBC41056E5
SHA1:	513716501759B5EC3ECAC0E60662E8F59F708AB4
SHA-256:	1C4DE1B12E00DEE53ECD26D2C8F18BB2C17A5E4403A30F6A0A24834CF3321388
SHA-512:	847306E2F352B18F14D586A893872EF8E3BDAAD016A15274C832DBF8D907154975F2816B5BDD9138E2C131F1920C2E9A8080E51F788DEB2AA30CD753D4FEF4E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzveK0Jng=="},"profile":{"info_cache":{},"profile_counts_reported":"13376658440579494","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1732184840"},"user_experien

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Local State~RF2e1cb.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5443902513238
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1+/emJFyX8x9WwgyikOJdXmuBuwBwja9IENhlA+X7QQRCYfYg:YuBqDPafuJM8vmZRBzB4iIelA+EB0
MD5:	385BE2D3EAEE8D782BB104CBC41056E5
SHA1:	513716501759B5EC3ECAC0E60662E8F59F708AB4
SHA-256:	1C4DE1B12E00DEE53ECD26D2C8F18BB2C17A5E4403A30F6A0A24834CF3321388
SHA-512:	847306E2F352B18F14D586A893872EF8E3BDAAD016A15274C832DBF8D907154975F2816B5BDD9138E2C131F1920C2E9A8080E51F788DEB2AA30CD753D4FEF4E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzveK0Jng=="},"profile":{"info_cache":{},"profile_counts_reported":"13376658440579494","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1732184840"},"user_experien

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Nurturing\campaign_history

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ShaderCache\data_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ShaderCache\data_1

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ShaderCache\data_2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ShaderCache\data_3

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ShaderCache\index

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl+nl/:Ls3+nt
MD5:	99234E126218656E2223089DB2CA0C26
SHA1:	C90AD9DF4F2206FE4632643FE7BA3C7CEEE0633D
SHA-256:	A0137F3B1DBFB1FA98C74CC33F80E1F46BF58BC90323A38D32CF3B5798103B72
SHA-512:	4FDBF72DDF9EA8A1EFF700EB267868CB6A0FE87CAE2536FB2086D8373AACF6A7EEF9862654FFFA38DBDE50AE0518CA8E5B46791FB3165493F7D0CA9741C84486
Malicious:	false
Preview:	........................................nD..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\customSynchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\customSynchronousLookupUris_0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\edgeSettings

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\edgeSettings_2.0-0

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\synchronousLookupUris

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\Variations

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Temp\chr6BC.tmp\ba7cbed2-d23d-4fba-9328-ab5bc55c5d3f.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5443902513238
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1+/emJFyX8x9WwgyikOJdXmuBuwBwja9IENhlA+X7QQRCYfYg:YuBqDPafuJM8vmZRBzB4iIelA+EB0
MD5:	385BE2D3EAEE8D782BB104CBC41056E5
SHA1:	513716501759B5EC3ECAC0E60662E8F59F708AB4
SHA-256:	1C4DE1B12E00DEE53ECD26D2C8F18BB2C17A5E4403A30F6A0A24834CF3321388
SHA-512:	847306E2F352B18F14D586A893872EF8E3BDAAD016A15274C832DBF8D907154975F2816B5BDD9138E2C131F1920C2E9A8080E51F788DEB2AA30CD753D4FEF4E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC+iLm2Zr7aQKM/QMbOv3p0EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABP3bqCLIIKULZltKi9naM/NsvjHziFuEObTMT1vXQENAAAAAAOgAAAAAIAACAAAABtMxtfCiQ0HI8W/DJehMIUsnPu/LG+d5TdDuLQSLjn5DAAAAC6rCjpeKykHLu1xImseQaYTi3WjJT27iNlfniGO7Co3Jrxmxi3LVrts6ZkzhjRGSVAAAAAHDkHlxhbJAEPhcLOFI09zETSMTMr9eCqhMrME9N2qmM6xEFhdzzUGADkw/sDe37nc9mKZvhc9lVMimzveK0Jng=="},"profile":{"info_cache":{},"profile_counts_reported":"13376658440579494","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1732184840"},"user_experien

C:\Users\user\AppData\Local\Temp\gifwhgt

Process:	C:\Users\user\task.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\apps.bat

Process:	C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.377806460743142
Encrypted:	false
SSDEEP:	3:mKDDFARE3BF//I+K9sALX:hmRACaALX
MD5:	F8ABF91D350D39FF1A48934B88624291
SHA1:	88EF29FD18441C628A43925A8B32535D39E07979
SHA-256:	5B4E3E3F739B1AE3CD907A0ABE9D5AAF51455551F69F9DA57E668F749584EFD6
SHA-512:	3C572C7415FBC8EE5F976AC9B6CCE43C901174777C859E9461451676BD5158E940E0BD173D83D980958295CB9DAACC489F0D596D98E93F71CB81D2603F037876
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..setlocal..cd /d "%~dp0"..start /B "" "task.exe"..endlocal..

C:\Users\user\data.bin

Process:	C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe
File Type:	data
Category:	dropped
Size (bytes):	482524
Entropy (8bit):	7.997356907892145
Encrypted:	true
SSDEEP:	12288:xVafxSS8uR/EN9QyGcEdjUi7hJqef1euJigVxNAjJ1mad:+pnoOKi7Hpf1Qwr41
MD5:	1CB29EF9003E93F65B93CE8B8B7C24DD
SHA1:	9BE4AA7AB2E4C71DC70D03AF435330C6BFB5C470
SHA-256:	9BE5145BAEB34D733AF9A7FA55139A4917EF080D777AC8EC7F5E8B42620605E6
SHA-512:	259EFB3FE2842908DCF4E4950DA40DBDC6803DDF0DD5BA6716486CB715F356068A94E066CEEFD4ED42D949787D6FC9190483C799ADD5D08620E16B4BC00BBA3C
Malicious:	false
Preview:	U......]..h.Z\...F...@...F..l7...cR.................y....a!......U=]XXV.....].m...J;...q.-.Vh.z."...n...w..>..U....Uh.1.T..>...7.s]...A2..a-...yw..-...........,.n_..\|)^..L..S7f~~~x.s.E....R..u..q.8888&-.n..3./......h..S6!.?....N:..........e..... ...\R..a'..>.I.....$M._.co.O.I..oooO.i$..".c..{.bx.TJ50...I.M,...k"-A......~.....[...O...+.........}[..hd..k......H.Yq....LI..ys.. . .Zy...6......h.......~;.........+.wn.mu........,.{.._$..`$%%...U&^Z........._........Y...IF}..kC..xg...........gj{..............v.+$X.....[_..883..kC.h.^...CW......<......N7..{W.a...VVVP......p..TTTB......o.....Q.......H.o~...i.......o.Nb87\|d.%........0....<...xI..vw..R..ye.....Z...b.\\89.0.f.R'...JK.&5D.1D.....W..y...\\Z)dfW..6?70..e..a...#.RR..P&._a]H....X.I.........#...nx.X.z..(..&..}\|.H...d..p....ATj.p^.osu5...c.c...Q^..HKCBB.s.::::...O.(.../.&....:....U..N^........:.....C..........6\....h..Ay..X....54s5..n.q.KG~F8m.xyyyE.J.Ex....[...e~...~..P...'K12.&..

C:\Users\user\g2m.dll

Process:	C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	617472
Entropy (8bit):	6.064860346549003
Encrypted:	false
SSDEEP:	12288:mwyPp3TItEKRC3YtYq0H+J6nEYpaM7Fd5ktc2/ZLvJ6Asu/uDc:mwggE2C3YtYq0eJgEYpaMnF2LvJ9/K
MD5:	FC284EEE599385A7AE9F098D123E983F
SHA1:	ACAA1C92D85AFD92184D49592AED3AEAB6AD2DED
SHA-256:	16414419A8248A4A55C05859C467D1FAFC298694F3F71916261FE2E08EBF4ABD
SHA-512:	C2538A98DE60AEDDB72CB14513ECCE3493F04E94135182AF658D3FC6425AD890560945EFB02C956B11AA10606C95E7CB286E73C0D27E71F2B17D3494506E7123
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D\.v..v..v...)..v.../."v......v.k./..v.k....v.k.)..v...+..v..v+..v.Z....v..v..v.Z...v.Z.(..v.Rich.v.................PE..L...Z=Bf.........."!...'.N...&...............`............................................@.........................p...........d............................P...G..@f..T....................f.......e..@............`...............................text....M.......N.................. ..`.rdata...e...`...f...R..............@..@.data....v.......l..................@....reloc...G...P...H...$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\task.exe

Process:	C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40376
Entropy (8bit):	5.902054884820747
Encrypted:	false
SSDEEP:	768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
MD5:	F1B14F71252DE9AC763DBFBFBFC8C2DC
SHA1:	DCC2DCB26C1649887F1D5AE557A000B5FE34BB98
SHA-256:	796EA1D27ED5825E300C3C9505A87B2445886623235F3E41258DE90BA1604CD5
SHA-512:	636A32FB8A88A542783AA57FE047B6BCA47B2BD23B41B3902671C4E9036C6DBB97576BE27FD2395A988653E6B63714277873E077519B4A06CDC5F63D3C4224E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.1..._..._..._......._...^..._......._......._......._.Rich.._.........................PE..L.....P.....................\|............... ....@.................................-........................................!..P....P...t..........................0 ............................................... ..0............................text...5........................... ..`.rdata....... ......................@..@.data........0......................@....CRT.........@......................@..@.rsrc....t...P...v..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\434f23.msi

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: 7-Zip 24.01 (x64) 24.1.0.0, Subject: 7-Zip 24.01 (x64), Author: Igor Pavlov, Keywords: Installer, Template: x64;1033, Revision Number: {5131F5EE-04FE-4DDC-B86B-F721A2EEC0E9}, Create Time/Date: Thu Jan 11 14:59:38 2024, Last Saved Time/Date: Thu Jan 11 14:59:38 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.884974179529995
Encrypted:	false
SSDEEP:	49152:BpRhaYJ+2/8yJ5OA4COg9lyp31X01clj+u1GTsF:BpDJ+2pgA4+6p31is+u1G4
MD5:	7C26877FCD894CC1355F2A31A551243C
SHA1:	80104216DA4CD3449EABF0E0DE2BB3A5B2DE85CA
SHA-256:	FF389718792F877FBDABE5CB02A1B3D5DE5BE988F9B5690250FFDF3409F04000
SHA-512:	A57A961A3339B105F9D5653B69269ED7AAB952A4E16600426EDEE80D628A9AC62A13B5EA642FFD9765FDADA7B0DB5C5A85A21BC88C125BE122BF3C4E89D0CFB8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI509A.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	212992
Entropy (8bit):	6.513409725320959
Encrypted:	false
SSDEEP:	3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5:	0C8921BBCC37C6EFD34FAF44CF3B0CB5
SHA1:	DCFA71246157EDCD09EECAF9D4C5E360B24B3E49
SHA-256:	FD622CF73EA951A6DE631063ABA856487D77745DD1500ADCA61902B8DDE56FE1
SHA-512:	ED55443E20D40CCA90596F0A0542FA5AB83FE0270399ADFAAFD172987FB813DFD44EC0DA0A58C096AF3641003F830341FE259AD5BCE9823F238AE63B7E11E108
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L...Y..e...........!.....h..........K................................................]....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{0028494D-9E28-4DD9-A336-17E8D634DF88}

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1640027875426617
Encrypted:	false
SSDEEP:	12:JSbX72FjzvQAGiLIlHVRpZh/7777777777777777777777777vDHFeyv3it/l0i5:J5vQQI5t81iF
MD5:	90C3BA3CF1C8E7FF1E56F68B3D22E302
SHA1:	EBCFE0F0610FE736E79DF8144649E08774A69E29
SHA-256:	D922C431BB3A8725626C54ACA6D03DACE34B0918064C419313C59360A7041E33
SHA-512:	83A71EF1A8CB026813A118C6D06B1FECA11727BEAE4D878DBFD78D5B34D3FE728D4D042707EEB814257C1F5C3D1637EA635B0CD64533A25BD76C66C852942CB8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.499693131712612
Encrypted:	false
SSDEEP:	48:j8PhquRc06WXJaFT5uVmdASPgsrlqdASBq4rl0kU:Khq1RFTwVxj4Fqq
MD5:	9E576925D6875B83750F21DECF01F3A8
SHA1:	5359EFB812F0F2F7948EEAC9E9AC5136C8D684A7
SHA-256:	CB59EBAE8CB3F3B0E1F74751E9A29044725699390B62747A7F72BBB8782E9822
SHA-512:	3A37CAAE6CB669607B85EFE5FC7E11FA8EBE51CD46339F777CA42209F4BE2C38B44382D7868E1D7F0028329AC92BD9BCB727281E131DEBAB7E6CF28EC54B3944
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\DPX\setupact.log

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	345054
Entropy (8bit):	4.386425894902289
Encrypted:	false
SSDEEP:	192:0K9KmK9KIK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7N:m
MD5:	0F10BF248874EB7BA14069DF267ABE7B
SHA1:	32AFF36EAEBF20CC60532B6FCB7B8B9F5BBD8A33
SHA-256:	542ABD593DBCA2277D5197EC101C299F16EAF277A260073695CC0F17BDBD2CD7
SHA-512:	75BBE373EDF8392151B45D6199A413F38E1F75FC08F1F61ED02BD0E37285ECA9E131FD4CE3BCAE961417441E998FD584F82711E7D68A81DEA03DA6AF917DE26E
Malicious:	false
Preview:	.2023-10-03 11:48:47, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX CJob::Resume completed with status: 0x0..2023-10-03 11:48:47, Info DPX Ended DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362965230318755
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauK:zTtbmkExhMJCIpE/
MD5:	E6ABBA528AFEB13655C512A8A9218579
SHA1:	A26121333027EAF6CEF995A4C4B9310D47B3C704
SHA-256:	ED4FD82B627B18E0B3E2E35029CD276F9FD1AF67555DB1A17059067FD1604EC3
SHA-512:	2AB1B0A2CCD27D557FD115707E0062E09F1CEF5C4311C7952BA0198087718157551643AF5210AE04829FF1B476DBFACB405872A1C09ADFEFA81E6BAB14EE29B8
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF1333532D6698F888.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.205240312217102
Encrypted:	false
SSDEEP:	48:JhiuQPveFXJLT5MVmdASPgsrlqdASBq4rl0kU:DigzTKVxj4Fqq
MD5:	4F1C3ADCCD9581C846CFC332386F6EA7
SHA1:	9DBCAB705685910ED82C2F5898FC1D687DF7AA5B
SHA-256:	D5F306E560E91FCE6D1671317D284984E7462972B68BE492AC6D3A413E426501
SHA-512:	B5BFF7C1B58E9FE8A8292078623DCB49F0BD093807B71F5D5944E4761871E23C2891CCDC5DF1ABB57E453A86626655BE59B1F6C334462EC629C2D15FCB8AE776
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF218C22ED6F4C8576.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07199368040356892
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOE4JOv2NvVMlXgVky6lit/:2F0i8n0itFzDHFeyvSbit/
MD5:	B9378D6330BEF697D3C7EB1EA04EC81F
SHA1:	E7C4072B790FB6D9554ABCC857171C871F3302F7
SHA-256:	876EDA1FD7020539489B6A11AB87114C6B8ED82069712227ED9D1FEA26A31639
SHA-512:	87B1947EDE1B8E9BEBEE9D847F3FF1F11817AD90640291DDC9F7566B02B54CF54E6F28E250B373576D766D01D9DC2FC0CD3D913454598D7D6CBD5FA604BAD118
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5F9E9BE5BF5CDDEB.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.499693131712612
Encrypted:	false
SSDEEP:	48:j8PhquRc06WXJaFT5uVmdASPgsrlqdASBq4rl0kU:Khq1RFTwVxj4Fqq
MD5:	9E576925D6875B83750F21DECF01F3A8
SHA1:	5359EFB812F0F2F7948EEAC9E9AC5136C8D684A7
SHA-256:	CB59EBAE8CB3F3B0E1F74751E9A29044725699390B62747A7F72BBB8782E9822
SHA-512:	3A37CAAE6CB669607B85EFE5FC7E11FA8EBE51CD46339F777CA42209F4BE2C38B44382D7868E1D7F0028329AC92BD9BCB727281E131DEBAB7E6CF28EC54B3944
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFADFAA71AA704D598.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC20ED811495708D5.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11761570969549515
Encrypted:	false
SSDEEP:	24:cUt91JfAebfdAipV7qqdAipVdVqKwGvlrkg9SUC+MNIR:cUt91rfdASBqqdASPgsrlCT
MD5:	5BE7C70C07FABD0EF5855D8097912C68
SHA1:	22577DEB128FE6073AC6524D6E41BE3823193547
SHA-256:	248D6057D06B0F1B59B15F6F5AC6A0FB32740180E8F94A601696FF448AE0F5AC
SHA-512:	495C5268B2C84ED85B8A90A78407156085D7A78E606AC6B8267CCA7EAFE0D946FEF9621658A37B7C2F015A0C5600776BBD341E8FED0024815555BC17A6E273C0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD848A46AF3D0AB12.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394436758265534
Encrypted:	false
SSDEEP:	6144:ml4fiJoH0ncNXiUjt10qMG/gaocYGBoaUMMhA2NX4WABlBuNA4OBSqa:m4vFMMYQUMM6VFYS4U
MD5:	976DF6563AD166C8B8F23F3CF2733190
SHA1:	16DC397221BFF8E766F62180AD93AE940561ECA7
SHA-256:	3F4C555F7542CE8525342BBA5477907A62213FFC3CDEBB7612BD13B235B81B2A
SHA-512:	F71A3EF4455FF5946458326A1029A414437F1372C4CC70AB7112F8E56B5C170F9667336294197FD9CBCE18CACB95C20985AB964E77DDF8E036D9FC003CC8E56B
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz7...;..............................................................................................................................................................................................................................................................................................................................................#...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	4.740731882997071
Encrypted:	false
SSDEEP:	6:zx3MmSLQHtBXVNsRpXqykHIqXQHX4qpIsHwD0DIZJQN80n:zK/0HtBFNEpxLTIc8D0DYJQl
MD5:	09AF173D6C2E576A83171FDACCDA4ECA
SHA1:	5EAF0E13191C130A35C1C79313434E9E47002B36
SHA-256:	EAA790702D8C7687456CCF4561950A1A3FDA0987C33CF2DFE07995E9144B91E3
SHA-512:	A7E39E6850B586203EFFB8BC89A53E259A38A9263C574EEA62F6C633DDEFEEA1D03B794040C56DBD2027436E455F1D48D857273EDAB6B71938EFE53823B2F2A3
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding files\data.bin to Extraction Queue..Adding files\g2m.dll to Extraction Queue..Adding files\run.bat to Extraction Queue..Adding files\task.exe to Extraction Queue..Adding files\task22.msi to Extraction Queue..Adding files\your_package_name.dll to Extraction Queue....Expanding Files ........Expanding Files Complete .....6 files total...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: 7-Zip 24.01 (x64) 24.1.0.0, Subject: 7-Zip 24.01 (x64), Author: Igor Pavlov, Keywords: Installer, Template: x64;1033, Revision Number: {5131F5EE-04FE-4DDC-B86B-F721A2EEC0E9}, Create Time/Date: Thu Jan 11 14:59:38 2024, Last Saved Time/Date: Thu Jan 11 14:59:38 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Entropy (8bit):	7.884974179529995
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	wE1inOhJA5.msi
File size:	1'753'088 bytes
MD5:	7c26877fcd894cc1355f2a31a551243c
SHA1:	80104216da4cd3449eabf0e0de2bb3a5b2de85ca
SHA256:	ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000
SHA512:	a57a961a3339b105f9d5653b69269ed7aab952a4e16600426edee80d628a9ac62a13b5ea642ffd9765fdada7b0db5c5a85a21bc88c125be122bf3c4e89d0cfb8
SSDEEP:	49152:BpRhaYJ+2/8yJ5OA4COg9lyp31X01clj+u1GTsF:BpDJ+2pgA4+6p31is+u1G4
TLSH:	FF85226136DAC136D55A093289EA97BA1629BE715B32C0CF37907D7D7E303D3A839312
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T11:26:52.782197+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49713	179.43.171.197	3393	TCP
2024-11-21T11:26:55.194507+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49715	179.43.171.197	3393	TCP
2024-11-21T11:26:55.194578+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49714	179.43.171.197	3393	TCP
2024-11-21T11:26:55.391739+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49716	179.43.171.197	3393	TCP
2024-11-21T11:26:56.599190+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49717	178.237.33.50	80	TCP
2024-11-21T11:27:04.162434+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	179.43.171.196	5982	192.168.2.9	49718	TCP
2024-11-21T11:27:25.180334+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	179.43.171.196	5982	192.168.2.9	49733	TCP
2024-11-21T11:27:25.180334+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	179.43.171.196	5982	192.168.2.9	49733	TCP
2024-11-21T11:27:37.095856+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	179.43.171.196	5982	192.168.2.9	49739	TCP
2024-11-21T11:27:37.095856+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	179.43.171.196	5982	192.168.2.9	49739	TCP
2024-11-21T11:27:44.401092+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	179.43.171.196	443	192.168.2.9	49740	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 11:26:51.318351030 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:51.443557024 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:51.443783998 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:51.451004982 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:51.570635080 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:52.728092909 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:52.782196999 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:52.963155985 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:52.967920065 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.087470055 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.087569952 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.207175970 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.540623903 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.543319941 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.664241076 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.731282949 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.733381033 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.742394924 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.782222986 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.845772982 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.853029013 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.853120089 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.858290911 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.863347054 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.863431931 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.868145943 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.965478897 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.965555906 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.969474077 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:53.977845907 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:53.987641096 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:54.088922024 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.138565063 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.147547960 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.194506884 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.194577932 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.238981009 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:26:55.344549894 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.359275103 CET	80	49717	178.237.33.50	192.168.2.9
Nov 21, 2024 11:26:55.359359980 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:26:55.359579086 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:26:55.371162891 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.376791954 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.383085012 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.388458967 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.391738892 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.479376078 CET	80	49717	178.237.33.50	192.168.2.9
Nov 21, 2024 11:26:55.496284008 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.496341944 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.508136034 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.508198977 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.597661018 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.603456020 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.611344099 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.616291046 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.627701998 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.723028898 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.723113060 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.730992079 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731014013 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731085062 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731118917 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731251001 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731302023 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731383085 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731446028 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731486082 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731518984 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731534958 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731566906 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731657982 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731678009 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731703043 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731723070 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.731811047 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.731864929 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.843924999 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.844008923 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.850686073 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.850698948 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.850775957 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.850872993 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.850905895 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.850922108 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.850975037 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851068020 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851130962 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851177931 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851195097 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851239920 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851264954 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851321936 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851373911 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851455927 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851614952 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851628065 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851686001 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.851847887 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.851908922 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.895268917 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.895353079 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.946154118 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946310043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946322918 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946330070 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946341038 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946356058 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946367979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946383953 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.946377993 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.946446896 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.946460009 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.954451084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.954540014 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.954893112 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.962780952 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962829113 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962841034 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962874889 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962888956 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.962893963 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962908983 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.962934017 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.962949038 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.963057995 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963071108 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963083029 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963099003 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963113070 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963135004 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.963167906 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.963706017 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.963836908 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.970464945 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.970693111 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.970731020 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.970742941 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.970777988 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.970822096 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.970824957 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.970879078 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.970987082 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971086979 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971157074 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971172094 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971235991 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971241951 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971247911 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971303940 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971455097 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971465111 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971486092 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971509933 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971550941 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971610069 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971649885 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.971652031 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.971697092 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.973525047 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.973536015 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.973655939 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.973696947 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.973805904 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.979414940 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.979798079 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:55.986869097 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.986929893 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.989929914 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.989981890 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.990034103 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:55.990046024 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.015067101 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.015090942 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.022110939 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.083298922 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.083401918 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090006113 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090018988 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090032101 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090219021 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090291977 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090308905 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090379000 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090445042 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090711117 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090734959 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090833902 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090845108 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090917110 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.090926886 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091017008 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091027975 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091088057 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091139078 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091226101 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091244936 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091324091 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091330051 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091470957 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091480970 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091547012 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091557026 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091665030 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091676950 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091768980 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091779947 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091835976 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091845036 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091906071 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.091927052 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.092012882 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.092022896 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093472004 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093485117 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093525887 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093535900 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093548059 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093657970 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.093683958 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.096263885 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.106503010 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.106518984 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.106563091 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.125946045 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.136076927 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.136185884 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.136245966 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.138473034 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.138578892 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.138629913 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.142016888 CET	3393	49716	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.142160892 CET	49716	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.146507025 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.146580935 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.146630049 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.152714968 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.152785063 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.152837038 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.154566050 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.154643059 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.154699087 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.158821106 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.158884048 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.158925056 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.160636902 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.160788059 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.160870075 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.165255070 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.165352106 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.165400028 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.168662071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.168768883 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.168817997 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.173759937 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.174026966 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.174222946 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.176664114 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.176801920 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.176857948 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.181982040 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.182100058 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.182151079 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.184772968 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.184859991 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.184911966 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.190366030 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.190433025 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.190474987 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.192682028 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.192774057 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.192826033 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.198748112 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.198865891 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.198947906 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.200664997 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.200846910 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.200898886 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.207144976 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.207220078 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.207278013 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.208725929 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.208900928 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.208949089 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.215584040 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.215670109 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.215718031 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.216731071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.216836929 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.216902018 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.224294901 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.224457026 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.224534035 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.232352018 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.232580900 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.232642889 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.245780945 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.245807886 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.245868921 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.249680996 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.255803108 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.297828913 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.297944069 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.327981949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.328002930 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.328063965 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.329813004 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.329919100 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.329965115 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.336307049 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.336349010 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.336404085 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.344120979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.344144106 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.344192982 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.347469091 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.347589970 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.347644091 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.349881887 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.349901915 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.349916935 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.349946022 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.350003958 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.350044012 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.354454994 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.354620934 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.354670048 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.355787039 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.355935097 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.355982065 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.361982107 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.362003088 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.362047911 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.362586975 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.362925053 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.363060951 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.367449045 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.367470026 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.367528915 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.369993925 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.370085955 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.370141029 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.372554064 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.372637987 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.372688055 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.378010035 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.378072023 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.378123999 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.378324986 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.378456116 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.378509045 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.384263039 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.384306908 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.384344101 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.385341883 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.385437012 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.385490894 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.392287970 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.392309904 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.392326117 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.392342091 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.392366886 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.392393112 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.395708084 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.395853043 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.395903111 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.396742105 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.396903992 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.396950960 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.399581909 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.399629116 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.399672985 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.401757002 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.401870966 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.401921988 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.404314995 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.404392004 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.404542923 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.407660961 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.407696009 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.407736063 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.409048080 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.409125090 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.409167051 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.414763927 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.414784908 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.414844990 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.414941072 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.414963961 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.414999008 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.419368982 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.419488907 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.419569969 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.420110941 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.420289040 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.420351982 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.424215078 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.424228907 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.424276114 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.426098108 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.426279068 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.426327944 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.428903103 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.429056883 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.429105997 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.431843996 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.432008982 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.432053089 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.433593035 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.433753967 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.433801889 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.436888933 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.436907053 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.436970949 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.438281059 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.438452959 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.438489914 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.441950083 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.441971064 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.442032099 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.443152905 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.443339109 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.443382025 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.446738005 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.446758986 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.446809053 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.447742939 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.448111057 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.448154926 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.452961922 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.453072071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.453125000 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.453819990 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.453836918 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.453891993 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.456537962 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.470535040 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.470558882 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.470628977 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.472820044 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.472965956 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.473016024 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.477615118 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.477724075 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.477778912 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.500960112 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.521970987 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.521992922 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.522051096 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.523472071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.523489952 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.523539066 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.528696060 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.528714895 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.528776884 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.533512115 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.533535004 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.533592939 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.537889004 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.538041115 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.538109064 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.539365053 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.539551020 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.539607048 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.541491985 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.541640997 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.541691065 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.542294979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.542311907 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.542363882 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.545919895 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.546498060 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.546819925 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.546978951 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.547429085 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.547476053 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.547600031 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.550707102 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.551130056 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.551178932 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.551956892 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.551971912 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.552016973 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.554744959 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.554760933 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.554807901 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.556061029 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.556111097 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.556178093 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.558829069 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.558965921 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.559006929 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.560079098 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.560245991 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.560296059 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.561825037 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.562006950 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.562056065 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.565673113 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.565735102 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.565921068 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.566112041 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.566128969 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.566176891 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.566855907 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.566907883 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.566921949 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.568217993 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.568464994 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.568825006 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.570540905 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.570584059 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.570636988 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.571289062 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.571391106 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.571443081 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.574153900 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.574264050 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.574291945 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.574387074 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.574433088 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.574476004 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.577478886 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.577521086 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.577560902 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.577701092 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.577760935 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.577826977 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.580493927 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.580609083 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.580781937 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.581159115 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.581242085 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.581288099 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.583410978 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.583542109 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.583666086 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.584508896 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.584568024 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.584589958 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.586381912 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.586549044 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.586597919 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.587889910 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.587928057 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.587948084 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.589364052 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.589459896 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.589534998 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.591259003 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.591330051 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.591353893 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.592292070 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.592330933 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.592376947 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.594640017 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.594695091 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.594723940 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.595323086 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.595448971 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.595499992 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.598098040 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.598128080 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.598145962 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.598397970 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.598447084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.598484039 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.599136114 CET	80	49717	178.237.33.50	192.168.2.9
Nov 21, 2024 11:26:56.599189997 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:26:56.600059032 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.600117922 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.600298882 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.601213932 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.601427078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.601475000 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.602034092 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.602092028 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.602161884 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.603996038 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.604049921 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.604079008 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.604165077 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.604181051 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.604290962 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.606205940 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.606261015 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.606309891 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.607192039 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.607330084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.607374907 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.608005047 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.608061075 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.608145952 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.610024929 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.610080957 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.610083103 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.610097885 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.610163927 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.610284090 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.611994028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.612045050 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.612076044 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.613023043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.613126993 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.613178968 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.613981009 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.614031076 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.614075899 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.616005898 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.616039991 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.616053104 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.616070032 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.616132021 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.616198063 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.618016958 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.618074894 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.618154049 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.618984938 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.619070053 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.619113922 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.619972944 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.620023012 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.620023012 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.621936083 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.622021914 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.622036934 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.622051001 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.622066021 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.622087955 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.623984098 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.624030113 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.624083996 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.624952078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.625094891 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.625144005 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.625974894 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.626019001 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.626080036 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.627876043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.627945900 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.627959967 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.627990961 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.628010035 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.628015041 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.629949093 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.630074024 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.630109072 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.630836964 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.631944895 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.632006884 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.632040024 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.672827005 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.672847033 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.711740017 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.711783886 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.711854935 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.712883949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.712949991 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.713267088 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.715203047 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.716118097 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.716161966 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.716204882 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.718472004 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.718565941 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.718614101 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.720814943 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.720864058 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.720895052 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.723030090 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.723089933 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.723119974 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.725240946 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.725295067 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.725368977 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.727396011 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.727427959 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.727442980 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.729510069 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.729573011 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.729608059 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.730319023 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.730559111 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.730612040 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.731329918 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.731492043 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.731620073 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.731676102 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.731678963 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.731745005 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.733392954 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.733416080 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.733470917 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.733696938 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.733742952 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.733798027 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.735389948 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.735410929 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.735450983 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.735858917 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.735944033 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.735970974 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.737349987 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.737468958 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.737550974 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.737795115 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.737855911 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.737873077 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.739301920 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.739370108 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.739406109 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.739795923 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.739859104 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.739888906 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.741231918 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.741255999 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.741300106 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.741736889 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.741780996 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.741846085 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.743158102 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.743243933 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.743334055 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.743733883 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.743782997 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.743835926 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.744965076 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.745028019 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.745074034 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.745707035 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.745737076 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.745755911 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.746723890 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.746815920 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.746855974 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.747560978 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.747616053 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.747648954 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.748446941 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.748584986 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.748719931 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.749501944 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.749552965 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.749566078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.750185013 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.750300884 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.750346899 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.751353979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.751384974 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.751410961 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.751846075 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.752027988 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.752072096 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.753169060 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.753221989 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.753350019 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.753488064 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.753515005 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.753556013 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.754992962 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.755099058 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.755141020 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.755147934 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.755170107 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.755217075 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.756737947 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.756870985 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.756889105 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.756902933 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.756925106 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.756974936 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.758342028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.758495092 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.758542061 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.758671999 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.758694887 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.758714914 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.759933949 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.760018110 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.760068893 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.760462999 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.760512114 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.760616064 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.761569023 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.761647940 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.761692047 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.762303114 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.762355089 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.762691021 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.763233900 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.763392925 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.763458967 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.764152050 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.764197111 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.764305115 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.764854908 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.765031099 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.765095949 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.766002893 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.766051054 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.766124964 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.766381979 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.766396046 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.766436100 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.767800093 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.767857075 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.767910957 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.767950058 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.767965078 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.768007994 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.769515038 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.769588947 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.769603014 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.769635916 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.769648075 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.769700050 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.771162033 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.771267891 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.771317959 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.771451950 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.771502972 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.771565914 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.772725105 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.772747040 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.772792101 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.773335934 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.773389101 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.773459911 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.774316072 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.774374962 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.774425983 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.775118113 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.775166988 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.775207043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.775942087 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.776038885 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.776082039 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.776698112 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.776923895 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.776976109 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.777028084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.777509928 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.777606010 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.777806044 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.777936935 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.778772116 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.778822899 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.778907061 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.779113054 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.779234886 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.779274940 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.780672073 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.780721903 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.780750036 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.780765057 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.780834913 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.780879974 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.782418966 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.782500029 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.782515049 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.782527924 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.782561064 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.782565117 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.783963919 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.784054041 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.784099102 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.784229994 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.784276009 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.784379005 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.785536051 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.785607100 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.785661936 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.786031008 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.786078930 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.786081076 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.787112951 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.787215948 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.787292957 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.787874937 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.787926912 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.787962914 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.788710117 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.788786888 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.788837910 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.789710045 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.789755106 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.789846897 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.790271997 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.790361881 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.790407896 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.791555882 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.791594028 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.791613102 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.791867971 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.791996002 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.792043924 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.793384075 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.793492079 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.793503046 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.793505907 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.793638945 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.793718100 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.795099020 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.795201063 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.795208931 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.795253038 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.795253992 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.795284033 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.796715021 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.796794891 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.796920061 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.796998024 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.797046900 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.797111034 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.798276901 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.798420906 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.798468113 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.798890114 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.798938990 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.799002886 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.799880028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.799994946 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.800035954 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.800651073 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.800698042 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.800760031 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.802185059 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.802244902 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.802290916 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.802495956 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.802537918 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.802612066 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.803088903 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.803199053 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.803256989 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.804133892 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.804341078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.804385900 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.804436922 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.804474115 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.804681063 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.804770947 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.804824114 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.806195974 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.806256056 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.806318998 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.806332111 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.806396961 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.806555986 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.807926893 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.808020115 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.808037996 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.808051109 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.808074951 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.808104038 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.809497118 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.809595108 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.809643030 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.809798002 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.809844971 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.809884071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.811091900 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.811163902 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.811224937 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.812711954 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.812731028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.812788963 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.831854105 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.903898001 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.903924942 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.903981924 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.904438972 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.904496908 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.904556036 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.905877113 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.905945063 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.905994892 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.907272100 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.907356977 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.907428980 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.908699036 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.908811092 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.910099983 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.910168886 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.910221100 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.910267115 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.911470890 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.911592007 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.911675930 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.912924051 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.913012981 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.913057089 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.914352894 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.914442062 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.914647102 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.915602922 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.915714979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.916055918 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.916944027 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.917047024 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.917129040 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.918276072 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.918330908 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.918382883 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.919596910 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.919702053 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.919747114 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.920959949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.921070099 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.921123981 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.922189951 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.922230005 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.922241926 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.922288895 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.922416925 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.922461033 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.922607899 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.922856092 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.923557043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.923609018 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.923618078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.923666954 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.924101114 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.924181938 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.924241066 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.924871922 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.924959898 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.924998045 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.925426960 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.925533056 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.925568104 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.926146030 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.926258087 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.926311016 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.926866055 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.926948071 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.926990032 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.927486897 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.927589893 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.927709103 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.928253889 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.928325891 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.928478956 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.928811073 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.928878069 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.928920984 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.929183960 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.929728031 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.929836988 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.929960966 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.930107117 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.930228949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.930411100 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.931086063 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.931215048 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.931252003 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.931417942 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.931574106 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.931797028 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.932487965 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.932621002 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.932763100 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.932820082 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.932914972 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.933043957 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.933917999 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.934043884 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.934082985 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.934098959 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.934134960 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.934175014 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.935340881 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.935374022 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.935388088 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.935420036 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.935514927 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.935559034 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.936775923 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.936817884 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.936832905 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.936873913 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.936891079 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.936930895 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.938050032 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.938163996 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.938179016 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.938193083 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.938220024 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.938231945 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.939382076 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.939584017 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.939599037 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.939613104 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.939636946 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.939651012 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.940654993 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.940720081 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.940866947 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.940963030 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.941078901 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.941129923 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.941973925 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.942085028 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.942312956 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.942349911 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.942460060 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.942504883 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.942650080 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.943300962 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.943392992 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.943789005 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.943840981 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.943876028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.943914890 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.944587946 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.944730997 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.944767952 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.945168018 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.945357084 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.945677996 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.945915937 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.946010113 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.946053982 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.946623087 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.946747065 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.946978092 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.947329044 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.947360992 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.947401047 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.948019028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.948127985 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.948185921 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.948542118 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.948652029 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.948714018 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.949429989 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.949532986 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.949577093 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.949856043 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.949960947 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.950001955 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.950824976 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.950934887 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.950978994 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.951194048 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.951245070 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.951297045 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.952464104 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.952507973 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.952549934 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.952635050 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.952649117 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.952661991 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.952708960 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.953675032 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.953815937 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.953833103 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.953855991 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.953946114 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.953990936 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.955079079 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.955215931 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.955238104 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.955252886 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.955282927 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.955319881 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.956393957 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.956486940 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.956501961 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.956526995 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.956573009 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.956671000 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.957597017 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.957731962 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.957819939 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.957827091 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.957878113 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.958604097 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.958734035 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.958851099 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.958908081 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.958972931 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.958981037 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.959021091 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.959934950 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.959994078 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.960042953 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.960221052 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.960273027 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.960381985 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.961157084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.961340904 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.961451054 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.961496115 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.961612940 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.961654902 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.962337971 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.962418079 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.962466002 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.962661028 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.962779999 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.963182926 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.963546038 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.963659048 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.963701963 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.963895082 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.964019060 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.964073896 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.964752913 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.964833975 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.964993954 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.965166092 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.965316057 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.965380907 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.965918064 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.966043949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.966386080 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.966408014 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.966435909 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.966485023 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.967113018 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.967288017 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.967367887 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.967696905 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.967782021 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.967828035 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.968323946 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.968511105 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.968597889 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.968887091 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.968995094 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.969158888 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.969527006 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.969645977 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.969758987 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.970141888 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.970240116 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.970594883 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.970730066 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.970813036 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.970858097 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.971359015 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.971401930 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.971498013 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.971848011 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.972634077 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.972750902 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.972790003 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.973855019 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.973957062 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.974164009 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.975146055 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.975291014 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.975336075 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.976339102 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.976444006 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.976607084 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.977576971 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.977693081 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.977744102 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.978841066 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.978981018 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.979027987 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.980098009 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.980254889 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.980300903 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.981645107 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.981734037 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.981786013 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.982772112 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.982858896 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.982909918 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.983829021 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.983880043 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.983926058 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.985007048 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.985107899 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.985199928 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.986278057 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.986336946 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.986407042 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.987524986 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.987606049 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.987684011 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.988775015 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.988850117 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.988909960 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.989994049 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.990075111 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:56.990118980 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:56.991274118 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.016676903 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.027501106 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.058432102 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.095796108 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.095884085 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.096302986 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.096349001 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.096429110 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.096462965 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.097289085 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.097383976 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.097441912 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.098355055 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.098412037 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.098515987 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.099426031 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.099540949 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.099580050 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.100498915 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.100605011 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.100703955 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.101558924 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.101684093 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.101747036 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.102596998 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.102710962 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.102767944 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.103684902 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.103801966 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.103846073 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.104723930 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.104847908 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.104902983 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.105806112 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.105916977 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.106369019 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.106884956 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.106947899 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.107145071 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.107927084 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.108030081 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.108139992 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.108999968 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.109061003 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.109132051 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.110075951 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.110882044 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.110934019 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.111113071 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.111227989 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.111268997 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.112159967 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.112241030 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.112274885 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.113251925 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.113370895 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.113554955 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.114377975 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.114396095 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.114406109 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.114424944 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.114455938 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.114494085 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.114947081 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.115057945 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.115098953 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.115434885 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.115550995 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.115592003 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.116187096 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.116318941 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.116400003 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.116451979 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.116689920 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.116743088 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.117284060 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.117419004 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.117481947 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:57.117604017 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.157196999 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.599703074 CET	80	49717	178.237.33.50	192.168.2.9
Nov 21, 2024 11:26:57.599829912 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:26:57.678349972 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.693440914 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:57.734553099 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:58.095228910 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:58.215002060 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:58.509723902 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:26:58.509778976 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:58.509819984 CET	49715	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:26:58.629873991 CET	3393	49715	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.508125067 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:01.627935886 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.627954006 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.627995014 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:01.628029108 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:01.628036976 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628052950 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628117085 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:01.628175020 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628194094 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628312111 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628407001 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628489971 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.628500938 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.747869015 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.747945070 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.747956991 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.748037100 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.748048067 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.748128891 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.748599052 CET	3393	49714	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:01.748672962 CET	49714	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:02.642129898 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:02.761740923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:02.761833906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:02.762192965 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:02.881863117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.041798115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.042768002 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.162434101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.459532022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.468025923 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.587578058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903100014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903146029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903162003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903178930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903232098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903229952 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.903244972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903258085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903271914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.903290987 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.903383017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.903465986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.913454056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.913481951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.913569927 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:04.919869900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.919928074 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:04.920048952 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.023814917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.079092979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.094933033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.094965935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.095113993 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.097367048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.097481966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.097532034 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.105282068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.105395079 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.105479002 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.113286972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.113399982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.113451004 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.121376038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.121463060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.121521950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.129301071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.129404068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.129450083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.137393951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.137459040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.137507915 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.145335913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.145451069 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.145494938 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.153336048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.153423071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.153467894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.161349058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.161459923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.161505938 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.169332981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.169476032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.169526100 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.198745966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.198815107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.198903084 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.214998007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.215044975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.215117931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.299751043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.300034046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.300090075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.303555965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.303659916 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.303723097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.311145067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.311342955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.311391115 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.318721056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.318833113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.318876028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.326360941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.326414108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.326473951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.333973885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.334052086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.334104061 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.339025021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.339212894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.339260101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.344172955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.344196081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.344245911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.349215031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.349332094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.349390984 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.352741957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.352855921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.352906942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.356262922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.356451035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.356502056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.359764099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.359879017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.360223055 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.363221884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.363336086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.363379002 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.366760015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.366868973 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.366925955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.370265007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.370435953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.370487928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.373769999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.373919964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.374070883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.377259970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.377392054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.377443075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.380877972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.380902052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.380947113 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.384274960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.384418011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.384552002 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.387763977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.387871981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.387916088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.391380072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.391501904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.391593933 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.419661999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.419735909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.419802904 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.421436071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.421554089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.421603918 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.426372051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.469724894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.478637934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.478754997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.478823900 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.480427027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.480532885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.480577946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.484878063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.491878986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.491942883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.492002964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.493594885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.493678093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.493689060 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.497104883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.497209072 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.497226000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.500590086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.500658989 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.500674963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.507205963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.507220030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.507253885 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.508444071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.508574963 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.508610964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.511564970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.511719942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.511898994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.514745951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.514786959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.514944077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.518017054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.518029928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.518057108 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.520925045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.520939112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.520989895 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.523797989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.523812056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.523854017 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.526809931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.526876926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.526973963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.529690027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.529833078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.529860973 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.532737970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.532821894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.532897949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.535562992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.535871983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.535945892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.538574934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.538620949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.538759947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.541567087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.541579962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.541647911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.543488026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.543545961 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.543584108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.547883987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.547898054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.547941923 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.549498081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.549658060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.549710989 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.551384926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.551398993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.551433086 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.553320885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.553494930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.553520918 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.555300951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.555321932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.555366039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.557214022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.557226896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.557264090 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.610347986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.671379089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.671545982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.671597004 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.672017097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.672179937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.672225952 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.674088001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.674237967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.674283028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.675909042 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.676067114 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.676110029 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.677819014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.677956104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.677998066 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.679657936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.685039997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.685082912 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.685200930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.685847998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.685892105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.685978889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.687633038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.687683105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.687777996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.689409971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.689455986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.689543962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.690351963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.690366030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.690402985 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.694011927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.694067955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.694161892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.694982052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.695115089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.695159912 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.696619034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.696661949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.696737051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.698262930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.698312044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.698563099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.700123072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.700176001 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.700404882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.702028036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.702075958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.702176094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.703789949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.703804970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.703844070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.705611944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.705625057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.705668926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.707341909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.707381010 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.707528114 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.709228992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.709275007 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.709410906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.710931063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.710979939 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.711081028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.712794065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.712841988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.712974072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.714534998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.714591026 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.714667082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.716387987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.716438055 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.716538906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.718115091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.718161106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.718261003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.719897032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.719908953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.719945908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.721664906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.721705914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.721847057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.723391056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.723445892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.723541975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.725294113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.725353003 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.725425959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.727020979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.727035046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.727067947 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.727834940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.727875948 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.727893114 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.731597900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.731646061 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.731724024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.732489109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.732501984 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.732541084 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.734262943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.734276056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.734313011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.736088991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.736131907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.736289024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.737875938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.737926006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.738029957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.739801884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.739814997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.739857912 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.741425991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.741439104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.741470098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.743233919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.743278980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.743383884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.744966984 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.745112896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.745135069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.746866941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.746881962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.746927023 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.748658895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.748795033 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.748802900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.750415087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.750427961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.750462055 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.752088070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.752242088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.752286911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.754015923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.754076958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.862401009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.862505913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.862562895 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.863192081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.863502979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.863554001 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.863590002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.865195990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.865261078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.865283966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.866487980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.866535902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.866626978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.868212938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.868259907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.868282080 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.870107889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.870172977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.870306015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.871419907 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.871475935 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.871534109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.873023033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.873068094 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.873122931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.876247883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.876276970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.876288891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.876319885 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.876358032 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.877737999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.877844095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.877892971 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.879189014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.879324913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.879370928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.880001068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.880155087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.880204916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.881539106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.881680012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.881762981 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.883073092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.883179903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.884505987 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.884639978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.884749889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.884836912 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.886136055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.886248112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.886336088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.887641907 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.887764931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.887810946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.889185905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.889305115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.889348030 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.890729904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.890841961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.890885115 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.892263889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.892445087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.892848015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.893764973 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.893965006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.894156933 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.895303965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.895410061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.895453930 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.896850109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.896945000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.897053957 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.898381948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.898478031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.899921894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.899979115 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.899997950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.900043011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.901417017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.901544094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.901598930 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.902951956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.903022051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.903062105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.904478073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.904548883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.904596090 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.906012058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.906122923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.906164885 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.907555103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.907594919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.907640934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.909111977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.909178972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.909230947 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.910628080 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.910725117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.910768986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.912136078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.912200928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.912252903 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.913675070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.913784981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.913829088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.915204048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.915304899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.915355921 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.916733027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.916810036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.916857958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.918314934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.918436050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.918493986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.919831991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.919946909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.919997931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.921305895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.921428919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.921475887 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.922858953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.923032999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.923089027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.924446106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.924484968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.924568892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.925916910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.926023006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.926073074 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.927439928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.927537918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.927603006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.929016113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.929116964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.929169893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.930566072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.930598021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.930644035 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.932019949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.932152033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.932200909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.933568954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.933670044 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.933717012 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.935096025 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.935184002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.935236931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.936649084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.936768055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.936850071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.938148975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.938270092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.938345909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.939699888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.939752102 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.939800978 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.941272020 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.941385031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.941484928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:05.942761898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.942819118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:05.942872047 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.182013035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.182034969 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.182091951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.229286909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.229305029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.229317904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.229382038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.282218933 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301506042 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301521063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301534891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301573038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301676989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301691055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301702023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301716089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301737070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301747084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301755905 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301759958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301769972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301781893 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301785946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301795006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301812887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301815987 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301825047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301840067 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301842928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301856041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301856995 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301867008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301878929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301892996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301898003 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301908016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301917076 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301919937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301932096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301944017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301963091 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.301983118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.301992893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302001953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302018881 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302022934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302031994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302043915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302057028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302057981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302064896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302078962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302090883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302093029 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302102089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302114964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302123070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302126884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302140951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302150011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302160978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302172899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302175999 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302184105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302196026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302196980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302206993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302221060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302228928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302232981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302244902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302257061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302264929 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302269936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302280903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302293062 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302299976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302310944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302313089 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302325010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302333117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302337885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302351952 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302365065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302369118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302376986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302396059 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302407026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302423000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302429914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302445889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302459955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302469969 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302470922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302484035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302495003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302503109 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302508116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302519083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302520037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302532911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302546978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302560091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302563906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302572012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302583933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302587986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302596092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302608967 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302622080 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302624941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302635908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302648067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302658081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302670002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302675009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302683115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302694082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302700996 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302707911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302720070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302721977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302731991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302737951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302753925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302768946 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302768946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302781105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302793026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302804947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302808046 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302819014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302831888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302835941 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302844048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302855968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302870989 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302872896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302886009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302891016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302900076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302911997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.302939892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.302966118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303092957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303105116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303118944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303132057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303144932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303153992 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303159952 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303168058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303173065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303178072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303184032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303189039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303204060 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303225994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303291082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303306103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303323984 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303335905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303354979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303354979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303366899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303378105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303380013 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303391933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303405046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303406954 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303419113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303431988 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303435087 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303451061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303458929 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303463936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303476095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303482056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303488016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303499937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303513050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303524971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303527117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303538084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303550959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303556919 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303564072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303575993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303589106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303602934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303611994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303611994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303616047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303628922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303641081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303649902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303653955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303667068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303670883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303682089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303694010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303699017 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303708076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303719044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303719997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303759098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303906918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303922892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303935051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.303970098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.303986073 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304074049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304088116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304099083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304111958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304122925 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304125071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304137945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304150105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304150105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304162979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304176092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304187059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304191113 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304198980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304210901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304217100 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304233074 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304239035 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304246902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304260015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304269075 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304280996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304290056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304299116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304311037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304321051 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304322958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304336071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304347992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304362059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304366112 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304373980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304387093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304392099 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304399014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304410934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304414988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304423094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304435015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304435015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304447889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304454088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304466963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304481030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304486990 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304493904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304507971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304514885 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304521084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304533958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304546118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304550886 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304557085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304569006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304582119 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304591894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304593086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304599047 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304615974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304627895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304627895 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304641962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304650068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304656029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304667950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304668903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304682970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304694891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304699898 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304729939 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.304928064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304948092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304961920 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304975033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304989100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.304994106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.305022955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.305054903 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.305062056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.305074930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.305116892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.306224108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.306348085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.306399107 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.307466984 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.307528019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.307569027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.309535980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.309626102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.346046925 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:06.347516060 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:06.348973989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.349081039 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.349138021 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.349584103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.349715948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.349868059 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.378592968 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.378693104 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.401951075 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.402044058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.402095079 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.421148062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.421171904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.421298027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.421684980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.421777964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.421830893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.423147917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.423190117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.423242092 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.424235106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.438715935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.438780069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.438872099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.439145088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.439201117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.439222097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.439822912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.439872980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.439933062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.440773010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.440830946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.440846920 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.441719055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.441844940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.441894054 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.442507982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.442548990 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.442634106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.443392992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.443469048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.443521023 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.452044964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.452105045 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.452271938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.452477932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.452523947 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.452528000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.453356028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.453406096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.453478098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.454195023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.454267979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.454489946 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.454564095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.454617977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.455374956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.455473900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.455519915 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.456501007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.456589937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.456639051 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.457170963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.457374096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.457467079 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.458112001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.458197117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.458244085 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.458945036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.459084034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.459131956 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.459831953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.460014105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.460058928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.460752964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.460819006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.460994959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.461610079 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.461746931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.461791992 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.462522030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.462624073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.462670088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.463375092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.463512897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.463593006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.464261055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.464451075 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.464495897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.465193987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.465296030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.465344906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.466075897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.466195107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.466237068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.467046976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.467130899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.467202902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.467834949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.467899084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.467936993 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:06.467952013 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.468746901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.468868017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.468918085 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.469604015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.469667912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.469724894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.470531940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.470577955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.470638037 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.471375942 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.471507072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.471556902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.472280025 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.472398043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.472485065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.473206043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.473489046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.473546028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.474054098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.474178076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.474226952 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.474920988 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.475984097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.476035118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.476106882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.476121902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.476171970 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.476713896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.476841927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.476891994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.477601051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.477813005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.477863073 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.478498936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.478652000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.478703976 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.479449987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.479526997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.479578018 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.480284929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.480350971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.480396032 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.481162071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.481273890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.481322050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.482040882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.482151031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.482198000 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.482990026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.483068943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.483185053 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.483829975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.483927965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.483978987 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.484724045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.485820055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.485865116 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.487517118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487535954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487550974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487561941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487576962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487586975 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.487591028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.487607002 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.487643957 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.488517046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.488673925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.488816023 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.489381075 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.489393950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.489435911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.490060091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.490170956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.490219116 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.490956068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.491071939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.491118908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.491827011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.491931915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.492247105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.492686987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.547840118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.630983114 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.631062031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.631192923 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.631553888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.631591082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.631644011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.632282019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.632551908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.632621050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.632802010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.633646011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.633660078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.633713961 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.634309053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.634365082 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.634435892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.634967089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.635020018 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.635062933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.635811090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.635891914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.644184113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.644201040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.644330978 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.644387960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.644501925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.644562006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.645575047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.645596027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.645667076 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.646119118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.646361113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.646408081 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.646440983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.647351027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.647363901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.647397995 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.649174929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.649194956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.649240971 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.649420977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.649434090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.649477005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.650037050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.650057077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.650089025 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.650648117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.650700092 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.650765896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.651535034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.651634932 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.651639938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.652389050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.652434111 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.652461052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.653599977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.653621912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.653666973 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.654330969 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.654342890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.654383898 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.655117035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.655133009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.655180931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.655803919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.655848980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.655926943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.656730890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.656780958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.656791925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.658103943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.658111095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.658162117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.658746004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.658760071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.658791065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.659614086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.659626961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.659688950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.660231113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.660278082 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.660334110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.661199093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.661211967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.661261082 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.661820889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.661865950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.661900043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.663069963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.663089037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.663125038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.663852930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.663865089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.663902998 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.664674997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.664689064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.664726019 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.665276051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.665328979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.665352106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.666546106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.666558027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.666716099 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.666975021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.667033911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.667534113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.667975903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.667987108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.668024063 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.668682098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.668730974 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.668817043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.670655012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.670667887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.670722008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.670833111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.670878887 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.671216965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.671255112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.671300888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.671415091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.672415972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.672430992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.672470093 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.672996998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.673048973 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.673127890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.674272060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.674290895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.674326897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.674973011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.674985886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.675023079 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.675772905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.675785065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.675828934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.676440001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.676506996 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.676811934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.677436113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.677449942 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.677505016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.678123951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.678177118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.678702116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.679276943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.679299116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.679335117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.679975033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.680027962 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.680221081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.680706978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.680778027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.680808067 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.681844950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.681862116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.681891918 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.682410002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.682461977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.682498932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.683684111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.683743000 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.822844028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.822942972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.823012114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.823224068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.823537111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.823585033 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.824079990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.824203014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.824246883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.824955940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.825126886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.825177908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.825825930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.826004028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.826117992 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.826695919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.826828003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.826869965 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.827542067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.827586889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.827627897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.836327076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.836378098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.836431980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.836658001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.836703062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.836764097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.837543964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.837656975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.837699890 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.838382959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.838659048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.838700056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.838785887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.839483023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.839534044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.839591980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.840357065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.840400934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.840476990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.841219902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.841268063 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.841316938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.842081070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.842130899 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.842201948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.842962980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.843005896 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.843070030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.843868971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.843914986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.843976021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.844651937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.844726086 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.844786882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.845573902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.845623016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.845727921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.846378088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.846431971 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.846470118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.847256899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.847302914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.847311020 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.848090887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.848165035 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.848207951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.848934889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.848982096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.849025965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.849778891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.849831104 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.849849939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.850650072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.850699902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.850754023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.851536989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.851583004 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.851640940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.852360010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.852415085 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.852525949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.853256941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.853303909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.853305101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.854072094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.854124069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.854198933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.854943037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.854986906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.854999065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.856014967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.856066942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.856141090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.856729031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.856781960 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.856821060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.857547998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.857604980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.857709885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.858374119 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.858428001 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.858458042 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.859220982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.859267950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.859267950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.860084057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.860137939 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.860178947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.860987902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.861044884 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.861197948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.861876011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.861907005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.861934900 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.862647057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.862698078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.862797976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.863550901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.863596916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.863660097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.864391088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.864448071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.864461899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.865245104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.865293026 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.865325928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.866115093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.866163969 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.866215944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.866988897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.867053986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.867079973 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.867810011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.867861986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.867913961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.868678093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.868736029 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.868789911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.869561911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.869616032 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.869637012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.870460033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.870507956 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.870568037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.871237040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.871292114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.871371031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.872102022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.872148037 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.872203112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.872972012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.873002052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.873019934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.873886108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.873939037 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.874015093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.874785900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.874835968 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:06.874918938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.875503063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:06.875560045 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.014909983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.015013933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.015074015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.015394926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.015500069 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.015558958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.016212940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.016302109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.016349077 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.017064095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.017182112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.017245054 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.017913103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.018029928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.018174887 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.018791914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.018891096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.018938065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.019668102 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.019777060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.019828081 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.028337955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.028417110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.028470039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.028781891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.028949976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.028995991 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.029568911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.029625893 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.029670954 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.030380011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.030637980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.030689001 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.030745983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.031493902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.031544924 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.031579018 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.032406092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.032479048 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.032531023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.033219099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.033269882 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.033385038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.034073114 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.034120083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.034255028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.034951925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.035029888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.035058975 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.035814047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.035864115 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.035923004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.036643982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.036690950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.036770105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.037537098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.037585974 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.037661076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.038374901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.038435936 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.038547993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.039263010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.039319038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.039432049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.040103912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.040165901 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.040188074 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.040961981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.041013956 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.041084051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.041835070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.041891098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.041929960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.042681932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.042747021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.042748928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.043498993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.043554068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.043611050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.044369936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.044461012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.044471979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.045211077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.045270920 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.045303106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.046113014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.046200991 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.046231031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.046960115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.047009945 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.047063112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.047811031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.047904015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.047910929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.048652887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.048707008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.048768997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.049530029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.049585104 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.049612999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.050518036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.050579071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.050697088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.051350117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.051399946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.051433086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.052095890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.052143097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.052177906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.052932024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.052977085 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.053040981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.053822041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.053869009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.053900957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.054658890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.054712057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.054759979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.055546045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.055630922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.055680990 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.056407928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.056478024 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.056508064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.057241917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.057296038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.057334900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.058105946 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.058154106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.058214903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.058965921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.059036970 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.059056044 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.059815884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.059870958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.059993029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.060681105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.060739040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.060770988 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.061567068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.061614037 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.061681032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.062452078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.062510967 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.062541962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.063220978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.063268900 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.063352108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.064470053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.064531088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.064598083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.065000057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.065012932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.065063000 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.065865040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.065912962 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.065938950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.066689014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.066741943 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.066788912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.067512989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.067563057 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.207781076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.207952023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.208112955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.208174944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.208435059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.208482981 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.208548069 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.209362030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.209376097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.209410906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.210138083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.210185051 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.210292101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.211146116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.211195946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.211229086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.211940050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.212021112 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.212080956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.212709904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.212762117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.220736980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.220756054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.220763922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.220766068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.220825911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.221467018 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.221565962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.221750021 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.224159956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.224580050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.224627972 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.224714041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.225476027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.225486994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.225502968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.225517988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.225550890 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.225613117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.226330996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.226370096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.226511002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.227128983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.227142096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.227179050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.228106976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.228168011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.228274107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.228782892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.228832960 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.228928089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.229737997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.229785919 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.229873896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.230561972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.230614901 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.230714083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.231379032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.231427908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.231565952 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.232220888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.232281923 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.232358932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.233187914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.233239889 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.233330965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.233992100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.234040022 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.234143019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.234846115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.234891891 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.235028982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.235666037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.235821962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.235830069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.236475945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.236525059 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.236629963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.237468004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.237545013 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.237617016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.238257885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.238413095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.238421917 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.239090919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.239141941 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.239269018 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.239900112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.239948988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.240082979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.240859985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.240873098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.240938902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.241635084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.241746902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.241921902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.242554903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.242608070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.242707014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.243362904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.243416071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.243540049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.244349957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.244414091 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.244482040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.245122910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.245172977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.245275021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.246017933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.246072054 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.246170044 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.246798992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.246855021 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.246946096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.247572899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.247622967 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.247788906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.248532057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.248589039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.248671055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.249566078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.249579906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.249624968 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.250175953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.250230074 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.250324011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.251147985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.251161098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.251205921 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.251905918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.251955986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.252099037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.252871990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.252932072 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.253026962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.253686905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.253736973 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.253880024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.254520893 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.254566908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.254704952 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.255549908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.255563974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.255600929 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.256325006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.256331921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.256375074 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.257142067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.257189989 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.257299900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258080959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258095026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258121014 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.258424044 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258436918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258477926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.258655071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.258702993 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.258899927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.260257959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.260317087 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.399111032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.399203062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.399259090 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.399432898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.399523973 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.399583101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.400309086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.400413036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.400458097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.401185036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.401272058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.401324034 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.402097940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.402173996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.402220011 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.402859926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.402944088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.403013945 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.403739929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.403753996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.403810978 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.412214041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.412327051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.412369013 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.412601948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.412797928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.412842989 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.413465977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.413614988 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.413661957 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.414280891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.414623976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.414671898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.414680958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.415518999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.415581942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.415692091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.416311026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.416394949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.416394949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.417176008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.417226076 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.417329073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.418050051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.418083906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.418102980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.418903112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.418953896 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.418982029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.419733047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.419784069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.419846058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.420576096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.420636892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.420681000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.421480894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.421533108 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.421575069 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.422314882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.422370911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.422430992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.423177958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.423226118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.423378944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.424041033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.424088955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.424125910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.424882889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.424937010 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.424973965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.425764084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.425812006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.425894022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.426601887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.426646948 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.426701069 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.427475929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.427514076 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.427556992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.428302050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.428363085 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.428395033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.429168940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.429215908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.429323912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.430053949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.430099010 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.430147886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.430895090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.430943012 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.430947065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.431766987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.431857109 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.431857109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.432583094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.432626009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.432693005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.433486938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.433535099 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.433573961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.434314013 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.434365034 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.434429884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.435235023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.435281038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.435352087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.436036110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.436083078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.436086893 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.436889887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.436935902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.436940908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.437762022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.437807083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.437926054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.438613892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.438662052 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.438663960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.439466000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.439585924 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.439649105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.440327883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.440381050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.440419912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.441184044 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.441229105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.441262007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.442110062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.442125082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.442192078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.442905903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.442975044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.443006992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.443770885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.443813086 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.443887949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.444611073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.444672108 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.444865942 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.445489883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.445596933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.445643902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.446331024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.446374893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.446424007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.447192907 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.447241068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.447263956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.448040962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.448081970 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.448167086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.448900938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.448995113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.449006081 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.449748993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.449793100 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.449858904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.450599909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.450655937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.450717926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.451435089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.451518059 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.591141939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.591231108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.591289043 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.591510057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.591584921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.591665983 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.592375040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.592489958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.592535973 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.593204975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.593322992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.593422890 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.594146967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.594295979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.594369888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.595015049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.595145941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.595206976 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.595781088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.595855951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.595892906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.604243994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.604331970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.604394913 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.604571104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.604736090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.604839087 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.605503082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.605581045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.606296062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.606345892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.606589079 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.606642008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.606694937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.607460976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.607511997 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.607534885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.608297110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.608339071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.608407974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.609165907 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.609260082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.609303951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.610011101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.610069036 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.610131979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.610892057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.610991955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.611033916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.611730099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.611790895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.611802101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.612637043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.612751961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.612819910 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.613437891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.613481998 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.613547087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.614331007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.614373922 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.614413023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.615236998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.615278006 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.615300894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.616010904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.616120100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.616167068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.616889954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.616935015 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.616974115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.617734909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.617785931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.617842913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.618609905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.618662119 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.618729115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.619513035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.619625092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.619676113 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.620307922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.620371103 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.620452881 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.621190071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.621264935 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.621304989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.622030973 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.622071981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.622077942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.622925043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.623120070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.623177052 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.623733997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.623774052 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.623831034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.624623060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.624680042 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.624699116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.625457048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.625504017 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.625560999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.626369953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.626421928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.626426935 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.627374887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.627430916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.627695084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.628729105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.628772020 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.628778934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.629750967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.629951000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.630000114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.630471945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.630520105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.630539894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.631083012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.631129026 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.631158113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.631592035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.631640911 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.631644964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.632333040 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.632379055 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.632446051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.633251905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.633295059 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.633405924 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.634049892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.634092093 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.634121895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.634929895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.634979963 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.635010958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.635752916 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.635797977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.635864019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.636631966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.636676073 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.636704922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.637495041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.637531996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.637545109 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.638381004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.638482094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.638523102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.639208078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.639255047 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.639308929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.640018940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.640067101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.640153885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.640929937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.640980005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.641061068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.641798019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.641894102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.641896009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.642647028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.642692089 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.642754078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.643457890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.643502951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.783430099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.783474922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.783621073 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.783816099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.783947945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.783989906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.784652948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.784763098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.784849882 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.785510063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.785648108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.785758018 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.786374092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.786510944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.786554098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.787235022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.787302971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.787349939 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.788089037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.788180113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.788233995 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.796247005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.796468019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.796526909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.796647072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.796936989 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.797051907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.797621965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.797734976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.797810078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.798320055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.798636913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.798681974 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.798758030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.799488068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.799537897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.799669981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.800354004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.800510883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.800538063 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.801213980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.801265955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.801299095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.802048922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.802107096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.802143097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.802908897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.802984953 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.803020000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.803778887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.803829908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.803891897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.804682970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.804730892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.804786921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.805481911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.805536985 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.805629969 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.806360960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.806406021 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.806538105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.807347059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.807398081 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.807399035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.808154106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.808206081 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.808267117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.808967113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.809020042 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.809052944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.809848070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.809900999 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.809932947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.810686111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.810739040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.810800076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.811523914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.811574936 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.811634064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.812407017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.812478065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.812546968 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.813260078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.813342094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.813539028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.814366102 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.814421892 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.814605951 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.815911055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.815924883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.815977097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.816328049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.816379070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.816612005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.817682981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.817771912 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.817878962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.818408966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.818454027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.818458080 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.818885088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.819009066 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.819067955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.819610119 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.819654942 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.819664001 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.820249081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.820301056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.820322990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.820950031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.820998907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.821032047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.821805954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.821858883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.821923971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.822688103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.822765112 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.822793007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.823522091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.823568106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.823673010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.824395895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.824435949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.824470997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.825267076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.825393915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.825793028 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.826265097 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.826284885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.826354980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.826936007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.826981068 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.827045918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.827869892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.827918053 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.827939987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.828669071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.828716993 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.828783035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.829734087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.829785109 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.829862118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.830385923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.830431938 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.830518961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.831252098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.831299067 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.831362009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.832113028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.832154036 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.832221985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.832964897 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.833008051 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.833065987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.833851099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.833899975 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.833924055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.834664106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.834712982 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.834768057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.835473061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.835614920 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.975688934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.975807905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.975895882 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.976066113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.976188898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.976241112 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.976950884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.977042913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.977135897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.977817059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.977931976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.977983952 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.978673935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.978785038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.978833914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.979518890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.979743958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.979789972 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.980359077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.980452061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.980494022 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.988322020 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.988418102 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.988466978 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.988729954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.988996029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.989044905 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.989545107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.989675045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.989722013 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.990380049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.990657091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.990714073 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.990835905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.991539001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.991595030 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.991647959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.992399931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.992520094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.992594957 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.993278027 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.993336916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.993419886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.994119883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.994169950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.994203091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.995021105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.995069027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.995109081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998240948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998320103 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.998358965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998364925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998369932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998416901 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.998456955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998495102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.998514891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998518944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998527050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.998564959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.999495983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:07.999547958 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:07.999619961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.000149965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.000193119 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.000206947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.000987053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.001095057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.001127005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.002321005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.002363920 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.002474070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.002685070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.002815962 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.002875090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.003521919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.003566980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.003602028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.004371881 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.004426956 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.004443884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.005279064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.005326986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.005448103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.006288052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.006336927 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.006346941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.006944895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.007019043 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.007047892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.007803917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.007884979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.007919073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.008665085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.008718967 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.008765936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.009514093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.009749889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.009824038 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.010360956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.010479927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.010566950 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.011251926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.011349916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.011404037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.012079000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.012162924 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.012276888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.012964010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.013011932 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.013065100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.013818026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.013880014 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.013930082 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.014672041 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.014719009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.014775991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.015541077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.015584946 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.015646935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.016370058 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.016423941 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.016474009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.017232895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.017311096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.017345905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.018131971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.018182039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.018194914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.018949986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.018997908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.019069910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.019814968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.019861937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.019942999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.020682096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.020751953 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.020777941 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.021569014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.021610022 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.021655083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.022378922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.022494078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.022521019 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.023231030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.023299932 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.023339987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.024122000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.024172068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.024187088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.024961948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.025007963 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.025068045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.025829077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.025873899 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.025945902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.026691914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.026737928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.026817083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.027498960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.027548075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.167733908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.167829990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.167913914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.168124914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.168239117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.168284893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.169011116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.169114113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.169167995 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.169851065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.169958115 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.170159101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.170691013 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.170794964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.170845032 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.171581984 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.171633005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.172193050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.172421932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.172502995 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.172549963 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.180310011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.180449963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.180504084 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.180671930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.180803061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.180876017 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.181555033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.181668043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.181873083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.182409048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.182523012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.182573080 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.183270931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.183371067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.183501959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.184115887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.184238911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.184726000 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.184994936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.185200930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.185360909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.185843945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.185959101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.186031103 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.186737061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.186800003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.186924934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.187572002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.187673092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.187720060 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.188409090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.188524008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.188576937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.189276934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.189392090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.189446926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.190126896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.190221071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.190272093 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.191031933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.191087008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.191135883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.191867113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.191972971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.192150116 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.192715883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.192817926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.192878962 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.193743944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.193837881 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.193902016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.194493055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.194590092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.194643974 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.195353985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.195395947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.195504904 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.196137905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.196289062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.196336031 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.197051048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.197210073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.197258949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.197870016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.197982073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.198191881 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.198725939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.198911905 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.198961020 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.199584007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.199691057 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.199738979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.200519085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.200532913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.200598955 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.201303005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.201395035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.201442003 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.202127934 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.202239037 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.202325106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.202977896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.203072071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.203128099 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.203882933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.203891039 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.203949928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.204721928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.204806089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.204859972 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.205607891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.205811977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.205991983 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.206430912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.206517935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.206571102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.207293987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.207405090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.207627058 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.208158016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.208271980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.208362103 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.209007978 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.209116936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.209872007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.209943056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.210055113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.210768938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.210841894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.210850000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.211596966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.211652994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.211720943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.212450981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.212512016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.212537050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.212841988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.213300943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.213435888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.213494062 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.214181900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.214265108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.214323997 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.215039968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.215212107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.215261936 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.215878010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.215959072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.216006994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.216737032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.216830015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.216877937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.217586994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.217672110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.217797995 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.218482971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.218571901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.218631983 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.219307899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.266602039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.359697104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.359798908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.359858990 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.360033035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.360256910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.360395908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.360400915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.361069918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.361195087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.361224890 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.361954927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.362013102 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.362073898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.362837076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.362888098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.362979889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.363647938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.363698959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.363756895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.364483118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.364584923 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.372239113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.372284889 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.372349977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.372416019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.372555017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.372642040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.373291016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.373435020 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.373613119 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.374119043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.374202967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.374254942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.374743938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.374845982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.374901056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.375611067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.375679970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.375730991 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.376470089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.376584053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.376631975 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.377319098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.377433062 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.377489090 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.378204107 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.378216028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.378264904 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.379050016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.379156113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.379209042 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.379934072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.379976034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.380023956 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.380820990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.380886078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.380934954 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.381633997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.381731987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.382220030 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.382473946 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.382602930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.382652044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.383342028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.383449078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.383505106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.384222031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.384381056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.384428978 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.385086060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.385152102 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.385217905 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.385973930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.386084080 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.386128902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.386806011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.386904955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.386954069 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.387607098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.387720108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.387788057 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.388499022 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.388608932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.388657093 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.389329910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.389441967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.389492035 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.390204906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.390301943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.390424967 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.391057014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.391155958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.391205072 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.391973019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.392019987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.392074108 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.392811060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.392878056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.392940044 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.393654108 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.393778086 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.393841982 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.394507885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.394546986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.394602060 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.395375967 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.395458937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.395509005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.396207094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.396318913 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.396369934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.397089005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.397221088 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.397300005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.397914886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.397996902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.398161888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.398792028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.398870945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.398917913 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.399638891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.399748087 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.399807930 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.400480986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.400600910 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.400682926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.401355982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.401482105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.401529074 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.402236938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.402323008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.402395010 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.403104067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.403302908 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.403356075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.403919935 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.404023886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.404071093 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.404793024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.404906034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.405038118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.405626059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.405742884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.405790091 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.406533957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.406637907 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.406747103 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.407361031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.407466888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.407521009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.408225060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.408317089 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.408365965 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.409086943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.409221888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.409277916 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.409923077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.410006046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.410054922 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.410767078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.410933971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.411007881 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.411617994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.454102039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.558945894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.559000015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.559130907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.559227943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.559348106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.559397936 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.560112000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.560231924 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.560292959 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.560945034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.561084986 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.561130047 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.561809063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.561908007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.561966896 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.562674046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.562777996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.562906027 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.563513994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.563601971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.563652039 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.564279079 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.564363956 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.564439058 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.564941883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.565047979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.565296888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.565788031 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.565846920 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.565905094 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.566646099 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.566768885 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.566816092 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.567504883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.567667961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.567760944 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.568350077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.568417072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.568454981 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.569233894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.569384098 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.569612980 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.570074081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.570193052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.570329905 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.570980072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.571033001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.571078062 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.571836948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.571856976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.571903944 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.572648048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.572774887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.572844982 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.573523998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.573689938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.573736906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.574353933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.574511051 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.574660063 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.575210094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.575391054 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.575438976 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.576101065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.576164007 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.576265097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.576962948 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.577013969 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.577058077 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.577986002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.578090906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.578254938 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.578646898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.578835964 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.578883886 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.579499960 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.579521894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.579602957 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.580358028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.580465078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.580513954 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.581196070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.581330061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.581377029 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.582053900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.582133055 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.582180023 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.582948923 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.583051920 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.583100080 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.583784103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.583887100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.583937883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.584639072 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.584758997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.584809065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.585520983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.585645914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.586179972 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.586350918 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.586405993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.586461067 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.587215900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.587321997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.587377071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.588097095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.588244915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.588414907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.588921070 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.589101076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.589162111 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.589816093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.589920998 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.589981079 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.590747118 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.590917110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.590965033 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.591517925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.591595888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.591667891 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.592397928 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.592607975 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.592654943 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.593322039 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.593432903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.593491077 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.594079971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.594206095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.594261885 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.595000982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.595048904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.595647097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.595803976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.595907927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.595957994 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.596669912 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.596817017 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.596944094 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.597537994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.597657919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.597712040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.598392010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.598550081 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.598706961 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.599253893 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.599360943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.599419117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.600159883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.600204945 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.600253105 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.600948095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.601018906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.601066113 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.602663994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.602678061 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.602714062 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.602736950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.602848053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.603368998 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.603518963 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.657211065 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.752356052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.753252983 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.753302097 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.753391981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.753405094 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.753443003 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.754085064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754096985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754108906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754122972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754134893 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.754170895 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.754515886 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754708052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.754755020 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.755409002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.755554914 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.755613089 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.756428957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.756443024 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.756483078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.757189035 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.757208109 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.757250071 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.757302999 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.757946014 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.757997036 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.758084059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.758723974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.758773088 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.758871078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.759530067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.759584904 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.759687901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.760499954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.760552883 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.760658979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.761425972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.761473894 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.761579990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.762238026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.762331963 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.762370110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.763035059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.763181925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.763269901 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.763864994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.763922930 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.764043093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.764868021 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.764883995 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.764997005 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.765692949 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.765707970 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.765788078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.766516924 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.766609907 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.766680002 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.767363071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.767513990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.767514944 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.768173933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.768237114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.768340111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.769155979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.769167900 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.769211054 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.769809961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.769860029 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.770006895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.770801067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.770857096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.770976067 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.771648884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.771661043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.771708012 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.772433996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.772488117 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.772613049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.773266077 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.773328066 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.773411036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.774133921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.774215937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.774295092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.775098085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.775110006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.775150061 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.775938034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.775990009 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.776289940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.776762962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.776809931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.776911974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.777617931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.777698040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.777772903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.778425932 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.778476000 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.778593063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.779417992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.779431105 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.779472113 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.780221939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.780308008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.780376911 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.781153917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.781199932 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.781318903 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.781966925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.782021046 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.782151937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.782788038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.782844067 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.782936096 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.783756971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.783768892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.783811092 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.784526110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.784662008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.784714937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.785377979 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.785392046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.785435915 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.786338091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.786355019 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.786390066 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.787195921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.787209034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.787220955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.787234068 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.787250996 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.787283897 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.787857056 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.787905931 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.787972927 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.789402962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.789453030 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.790632010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.791842937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.791906118 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.792130947 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.792290926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.792303085 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.792349100 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.792484045 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.792495966 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.792537928 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.793325901 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.793339968 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.793387890 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.794024944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.794037104 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.794090986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.794831038 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.794842958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.794902086 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.795638084 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.795687914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.795788050 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.796417952 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.796544075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.943631887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.943780899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.943850040 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.944042921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.944152117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.945163965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.945228100 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.945400953 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.945449114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.946913958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.947160006 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948031902 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948095083 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.948193073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948244095 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.948470116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948484898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948522091 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.948812962 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.948868990 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.949680090 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.949723005 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.949733019 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.949765921 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.950130939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.950181961 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.950726032 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.950778008 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.950808048 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.950859070 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.951493025 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.951653957 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.951704979 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.952644110 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.952723026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.952770948 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.953202009 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.953310013 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.953759909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.953818083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.953917980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.953965902 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.954346895 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.954406977 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.954461098 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.955007076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.955121994 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.955235004 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.956064939 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.956162930 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.956221104 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.957035065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.957093000 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.957600117 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.957659960 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.957674026 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.957715988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.958376884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.958504915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.959263086 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.959470987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.959595919 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.960083008 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.960135937 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.960212946 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.960261106 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.960944891 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.961072922 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.961822033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.961909056 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.961941004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.961992025 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.962698936 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.962903023 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.963435888 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.963498116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.963607073 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.964421034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.964485884 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.964550972 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.964595079 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.965322018 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.965442896 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.966087103 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.966172934 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.966207981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.966258049 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.966944933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.967053890 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.967119932 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.967803001 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.967916965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.968697071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.968761921 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.968775034 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.968832016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.969537020 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.969671965 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.970401049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.970463037 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.970547915 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.970593929 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.971271992 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.971335888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.971395969 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.972110987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.972202063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.972932100 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.972995043 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.973073959 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.973123074 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.973799944 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.973912954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.974682093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.974733114 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.974762917 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.974812031 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.975531101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.975657940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.975714922 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.976546049 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.976674080 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.977426052 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.977484941 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.977495909 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.977541924 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.978097916 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.978210926 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.978980064 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.979034901 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.979104996 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.979150057 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.979835987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.980056047 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.980128050 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.980709076 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.980811119 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.981048107 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.981554985 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.981653929 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.981699944 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.982400894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.982522011 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.982573986 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.983247995 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.983381987 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.983431101 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.984111071 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.984219074 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.984270096 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.984970093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.985074997 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.985126019 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.985841036 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.985941887 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.985990047 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.986712933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.986862898 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:08.986967087 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:08.987533092 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.032260895 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.136459112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.136518955 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.136663914 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.136981010 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.137079954 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.137130022 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.137828112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.137959003 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.138006926 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.138643980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.138679981 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.138741970 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.139487982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.139615059 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.139662981 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.140369892 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.140448093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.140846968 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.141230106 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.141371012 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.141422987 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.141741991 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.141881943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.141931057 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.142625093 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.142735004 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.142797947 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.144066095 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.144386053 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.144464016 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.145116091 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.145181894 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.145231962 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.145750046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.145977974 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.146029949 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.146502018 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.146570921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.147093058 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.147308111 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.147448063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.147494078 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.148116112 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.148231030 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.148282051 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.148832083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.148922920 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.148972988 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.149895906 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.149939060 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.149985075 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.150635958 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.150794029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.150849104 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.151321888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.151345015 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.151412010 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.152225971 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.152338028 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.152805090 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.152901888 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.152977943 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.153031111 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.153783083 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.153856993 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.153908014 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.154658079 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.154709101 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.154757977 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.155441046 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.155571938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.155618906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.156332016 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.156413078 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.156462908 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.157193899 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.157362938 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.157524109 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.158108950 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.158194065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.158240080 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.159079075 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.159224033 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.159272909 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.159781933 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.159888029 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.159935951 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.160617113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.160657883 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.160702944 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.161501884 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.161600113 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.161649942 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.162406921 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.162488937 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.162569046 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.163220882 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.163271904 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.163821936 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.164056063 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.164274931 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.164324999 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.164932013 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.165014982 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.165062904 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.165750980 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.165885925 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.165993929 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.166640043 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.166691065 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.166738033 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.167538881 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.167608976 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.167658091 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.168414116 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.168469906 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.168947935 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.168998003 CET	49718	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:09.288368940 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:09.288420916 CET	5982	49718	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:23.626878023 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:23.746896982 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:23.746993065 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:23.747092962 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:23.867538929 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.048948050 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.048981905 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.049031973 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:25.060914993 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:25.180334091 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.475290060 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.477215052 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:25.597489119 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.893578053 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:25.896456003 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:26.016197920 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:26.016922951 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:26.137276888 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:26.448061943 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:26.450794935 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:26.572515011 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:26.572694063 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:26.692384005 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.004303932 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.004350901 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.004415989 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.038630962 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.038723946 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.038799047 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.047475100 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.159903049 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.159997940 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160027981 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160063028 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160090923 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160111904 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.160113096 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.160145044 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160173893 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.160173893 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160232067 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.160274029 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160307884 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.160367966 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.169284105 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.169331074 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.169348955 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.169377089 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.169385910 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.169415951 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.169466972 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280447960 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280463934 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280553102 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280558109 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280599117 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280638933 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280699015 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280740023 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280847073 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.280877113 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280899048 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.280944109 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.281002045 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.281033993 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.281086922 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.289102077 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.298434019 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.326888084 CET	49736	443	192.168.2.9	172.64.41.3
Nov 21, 2024 11:27:27.326925993 CET	443	49736	172.64.41.3	192.168.2.9
Nov 21, 2024 11:27:27.326994896 CET	49736	443	192.168.2.9	172.64.41.3
Nov 21, 2024 11:27:27.327334881 CET	49737	443	192.168.2.9	162.159.61.3
Nov 21, 2024 11:27:27.327368975 CET	443	49737	162.159.61.3	192.168.2.9
Nov 21, 2024 11:27:27.327418089 CET	49737	443	192.168.2.9	162.159.61.3
Nov 21, 2024 11:27:27.327689886 CET	49736	443	192.168.2.9	172.64.41.3
Nov 21, 2024 11:27:27.327703953 CET	443	49736	172.64.41.3	192.168.2.9
Nov 21, 2024 11:27:27.327815056 CET	49737	443	192.168.2.9	162.159.61.3
Nov 21, 2024 11:27:27.327831984 CET	443	49737	162.159.61.3	192.168.2.9
Nov 21, 2024 11:27:27.401503086 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401540995 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401571035 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401606083 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401678085 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401706934 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.401804924 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.402004004 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.402035952 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.402064085 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.625348091 CET	49737	443	192.168.2.9	162.159.61.3
Nov 21, 2024 11:27:27.665549040 CET	49736	443	192.168.2.9	172.64.41.3
Nov 21, 2024 11:27:27.853343964 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:27.880400896 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.880515099 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.880856037 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:27.999964952 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000041008 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.000149012 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000186920 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000217915 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000268936 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000407934 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000461102 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000562906 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.000598907 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.119879007 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.532931089 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.536443949 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.536533117 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.536602020 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.536741972 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.536763906 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:28.656502962 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656702995 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656713963 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656723976 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656733990 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656743050 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656831026 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656881094 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656889915 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656909943 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656982899 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.656994104 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.657139063 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.657161951 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.657217026 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:28.967474937 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:29.011188030 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:29.964420080 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:30.150887012 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.150970936 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:30.271365881 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.563663960 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.563854933 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.563956022 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.564009905 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:30.568346977 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:30.568376064 CET	49733	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:30.688416958 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:30.688749075 CET	5982	49733	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:35.563978910 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:35.683742046 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:35.683886051 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:35.683974028 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:35.803973913 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:36.409652948 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:36.410898924 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:27:36.533663034 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:27:36.966964960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:36.967031002 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:36.967078924 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:36.976203918 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:37.095855951 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:37.391475916 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:37.391738892 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:37.511307001 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:37.807265997 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:37.809811115 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:37.932796001 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:37.932859898 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.053468943 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.368061066 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.371697903 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.491194010 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.491282940 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.610938072 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.923063040 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.930568933 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.930618048 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.930674076 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.930692911 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.930731058 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.930749893 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.938975096 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.939053059 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.939071894 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.946614027 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.946671963 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.946703911 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.954912901 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.954981089 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.955008030 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.959830999 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.959883928 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.960000992 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.968231916 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:38.968286991 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:38.968323946 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.016788960 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.122673035 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.122818947 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.122941971 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.126768112 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.126893044 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.126959085 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.134963036 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.138242960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.138309002 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.138358116 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.146296024 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.146363974 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.146389008 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.154548883 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.154582024 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.154635906 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.162749052 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.162844896 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.162880898 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.171061993 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.171148062 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.171169996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.179322004 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.179385900 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.179415941 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.187695026 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.187747002 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.187787056 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.195823908 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.195939064 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.195949078 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.204135895 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.204164982 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.204229116 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.212466002 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.212528944 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.212543011 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.221143961 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.221215010 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.314850092 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.314960003 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.315016985 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.317157984 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.317239046 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.317293882 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.325520039 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.325601101 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.325648069 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.335871935 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.336066961 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.336126089 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.343266964 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.343348026 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.343389988 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.350312948 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.350353003 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.350404978 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.356297016 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.356364012 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.356424093 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.363107920 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.363132954 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.363218069 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.369816065 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.369961023 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.370018959 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.376665115 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.376725912 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.376775026 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.383430958 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.383543015 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.383588076 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.390300035 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.390398026 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.390450954 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.397243977 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.397419930 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.397474051 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.403812885 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.403834105 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.403882027 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.410717964 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.410835028 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.410883904 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.417534113 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.417553902 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.417603970 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.424186945 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.424279928 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.424320936 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.430974960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.431087017 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.431128979 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.437998056 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.438137054 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.438184977 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.444618940 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.444780111 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.444825888 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.451587915 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.451610088 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.451693058 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.458385944 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.458404064 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.458481073 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.464940071 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.465049028 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.465109110 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.471750975 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.471831083 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.471889973 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.478663921 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.478715897 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.478756905 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.485312939 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.506889105 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.506963015 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.507018089 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.509434938 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.509519100 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.509635925 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.514659882 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.514746904 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.514771938 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.519838095 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.519897938 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.519932985 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.524947882 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.525044918 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.525057077 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.529956102 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.530026913 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.530050039 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.534683943 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.534733057 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.534785986 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.539366007 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.539402008 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.539441109 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.543834925 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.543951035 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.544024944 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.548275948 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.548362017 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.548382044 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.552560091 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.552664042 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.552680969 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.557024002 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.557090998 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.557137012 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.560964108 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.561029911 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.561052084 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.565049887 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.565104008 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.565141916 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.569173098 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.569224119 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.569319010 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.573174953 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.573232889 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.573245049 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.577130079 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.577188969 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.577192068 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.581108093 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.581172943 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.581202030 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.583771944 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.583837032 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.584105968 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.586314917 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.586371899 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.586447954 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.588557005 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.588610888 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.588746071 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.591546059 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.591594934 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.591620922 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.593497038 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.593547106 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.593720913 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.595812082 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.595861912 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.596112013 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.598237991 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.598313093 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.598361015 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.600801945 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.600881100 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.601155996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.603060007 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.603116035 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.603141069 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.605479956 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.605531931 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.605622053 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.607882977 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.607930899 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.607971907 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.610404968 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.610467911 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.610527039 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.612656116 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.612709999 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.612772942 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.615041971 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.615111113 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.615175009 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.617523909 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.617579937 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.617594957 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.619867086 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.619924068 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.620022058 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.622257948 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.622313023 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.622339964 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.624708891 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.624771118 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.624877930 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.627060890 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.627132893 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.627173901 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.629439116 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.629491091 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.629492998 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.631822109 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.631885052 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.631903887 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.634242058 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.634305954 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.634337902 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.636691093 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.636761904 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.636784077 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.638972998 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.639050007 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.639070988 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.641371012 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.641449928 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.641483068 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.643712997 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.643824100 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.698503017 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.698616028 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.698677063 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.699520111 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.700040102 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.700107098 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.700185061 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.702054977 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.702111006 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:39.702155113 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:39.751215935 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:41.960077047 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.079591036 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.079807997 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.199246883 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.515121937 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.515258074 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.515328884 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.515386105 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.516048908 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.516119003 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.516304016 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.516412020 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.516469002 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.517385006 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.517398119 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.517477036 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.518150091 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.518383980 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.518445969 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.519191980 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.519355059 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.519422054 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.519474030 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.520463943 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.520528078 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.520584106 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.521532059 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.521599054 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.521960974 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.522059917 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.522114992 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.523046970 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.523163080 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.523226976 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.524092913 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.524508953 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.524568081 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.524571896 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.525598049 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.525674105 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.525686026 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.526684046 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.526750088 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.526777029 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.527864933 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.527939081 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.527942896 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.528845072 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.528904915 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.528959990 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.529972076 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.530039072 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.530101061 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.531016111 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.531076908 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.531132936 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.532085896 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.532140970 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.532187939 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.533212900 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.533278942 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.533333063 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.534265995 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.534320116 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.534365892 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.535343885 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.535414934 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.535432100 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.536415100 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.536454916 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.536550045 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.537501097 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.537538052 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.537621975 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.538655043 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.538701057 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.538789988 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.539673090 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.539714098 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.539757013 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.540796995 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.540842056 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.540870905 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.541855097 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.541901112 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.542045116 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.542943001 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.542985916 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.543030977 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.544032097 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.544071913 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.544107914 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.545106888 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.545150995 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.545205116 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.546201944 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.546278000 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.546295881 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.547283888 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.547342062 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.547369003 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.548460960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.548475027 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.548548937 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.549452066 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.549525023 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.549582005 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.550523996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.550584078 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.550637960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.551672935 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.551733017 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.551825047 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.552710056 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.552778006 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.552813053 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.553900957 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.553962946 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.553976059 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.555278063 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.555358887 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.555422068 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.556684017 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.556761980 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.669018030 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.788713932 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.788836956 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.908555031 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.937489986 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.937530041 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:42.937686920 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.937686920 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:42.937721968 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.226027966 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.226094007 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.226264954 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.226294994 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.227400064 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.227463007 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.227607012 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.227689981 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.227780104 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.228540897 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.228594065 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.228648901 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.229054928 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.229172945 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.229227066 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.230180979 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.230329037 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.230384111 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.230386019 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.231447935 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.231499910 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.231718063 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.232803106 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.232855082 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.233179092 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.233232975 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.233279943 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.234060049 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.234095097 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.234147072 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.235213995 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.235274076 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.235327959 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.236248970 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.236406088 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.236474037 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.237199068 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.237330914 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.237406969 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.238475084 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.238533974 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.238600016 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.239429951 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.239563942 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.239639044 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.240463972 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.240573883 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.240648031 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.241559982 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.241688967 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.241761923 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.242631912 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.242737055 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.242810965 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.243709087 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.243769884 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.243834972 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.244812965 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.244940996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.245012999 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.245841980 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.245959997 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.246032000 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.247104883 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.247230053 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.247292042 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.248028994 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.248130083 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.248203993 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.249109983 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.249192953 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.249260902 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.250189066 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.250238895 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.250304937 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.251276016 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.251399040 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.251493931 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.252446890 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.252522945 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.252582073 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.253458023 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.253597021 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.253659010 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.254528999 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.254647970 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.254709005 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.255614996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.255709887 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.255770922 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.256705999 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.256822109 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.256894112 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.257823944 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.257875919 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.257942915 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.258918047 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.259120941 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.259196043 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.259964943 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.260107040 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.260179043 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.261065960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.261161089 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.261228085 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.262221098 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.262324095 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.262409925 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.263242960 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.263379097 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.263448000 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.264309883 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.264431000 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.264501095 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.265403032 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.265625000 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.265708923 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.266524076 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.266583920 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.266633987 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.267585993 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.267697096 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.267749071 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.268691063 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.268913031 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.268979073 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.269902945 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.269954920 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.270004034 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.270828009 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.270929098 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.270984888 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.271943092 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.272069931 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.272130013 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.272994041 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.273103952 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.273153067 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.274076939 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.274197102 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.274243116 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.275223017 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.275367022 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.275424004 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.276246071 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.276369095 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.276408911 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.277370930 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.277479887 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.277527094 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.278424978 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.278546095 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.278615952 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.279495955 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.279613972 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.279664993 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.280582905 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.280713081 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.280756950 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.281681061 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.281812906 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.281857967 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.282746077 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.282895088 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.282942057 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.283837080 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.329299927 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.418308973 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.418374062 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.418435097 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.418992996 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.419193983 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.419235945 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.420516968 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.420571089 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.420608044 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.421207905 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.421467066 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.421504021 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.421622038 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.422408104 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.422454119 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.422483921 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.423480034 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.423521042 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.423624039 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.424592972 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.424629927 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.424911976 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.425137043 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.425172091 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.425981998 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.426099062 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.426136971 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.427063942 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.427175999 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.427212000 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.428143978 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.428457022 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.428509951 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.565766096 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.685338974 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:43.685520887 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:43.808263063 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.120212078 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.120248079 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.120321989 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.120332003 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.121269941 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.121309996 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.121501923 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.121673107 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.121704102 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.122289896 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.122351885 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.122383118 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.122797012 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.122967005 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.122998953 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.123738050 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.123955011 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.123987913 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.124000072 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.124608040 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.124640942 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.124646902 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.125155926 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.125190973 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.125485897 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.125610113 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.125643015 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.126368046 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.126451969 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.126482964 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.127414942 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.127535105 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.127564907 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.128479004 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.173026085 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.295793056 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.396315098 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.396595001 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.401081085 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.401092052 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.401484966 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.403050900 CET	49740	443	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.418695927 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.418761969 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.447333097 CET	443	49740	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.540762901 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.848042011 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.848069906 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.848113060 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.848150015 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.848197937 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.848226070 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.848263979 CET	49739	5982	192.168.2.9	179.43.171.196
Nov 21, 2024 11:27:44.967978954 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:27:44.968014002 CET	5982	49739	179.43.171.196	192.168.2.9
Nov 21, 2024 11:28:06.492043972 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:28:06.494342089 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:28:06.615113020 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:28:36.565303087 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:28:36.613106012 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:28:36.732742071 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:28:44.985904932 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:28:45.470071077 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:28:46.173247099 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:28:47.470166922 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:28:49.985687017 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:28:54.970175982 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:29:04.579682112 CET	49717	80	192.168.2.9	178.237.33.50
Nov 21, 2024 11:29:06.615675926 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:29:06.618191004 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:29:06.738414049 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:29:36.695317984 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:29:36.722345114 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:29:36.841972113 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:30:06.740603924 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:30:06.741947889 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:30:06.861865997 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:30:36.811620951 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:30:36.814805984 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:30:36.938261032 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:31:06.869218111 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:31:06.874459028 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:31:06.995177031 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:31:36.955697060 CET	3393	49713	179.43.171.197	192.168.2.9
Nov 21, 2024 11:31:37.002933979 CET	49713	3393	192.168.2.9	179.43.171.197
Nov 21, 2024 11:31:37.122569084 CET	3393	49713	179.43.171.197	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 11:26:51.066031933 CET	56681	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:26:51.315473080 CET	53	56681	1.1.1.1	192.168.2.9
Nov 21, 2024 11:26:55.007359028 CET	55599	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:26:55.234137058 CET	53	55599	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:13.991122007 CET	65407	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:13.992580891 CET	59049	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:13.992774963 CET	51791	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:13.992835045 CET	53672	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:13.993098974 CET	61049	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:13.993211031 CET	49951	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:14.219158888 CET	53	59049	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:14.219232082 CET	53	61049	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:14.219321966 CET	53	53672	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:14.220230103 CET	53	49951	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:14.232342958 CET	53	51791	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:14.233165979 CET	49952	123	192.168.2.9	62.149.0.30
Nov 21, 2024 11:27:14.233216047 CET	49952	123	192.168.2.9	193.171.23.163
Nov 21, 2024 11:27:14.233261108 CET	49952	123	192.168.2.9	169.229.128.134
Nov 21, 2024 11:27:14.233366966 CET	49952	123	192.168.2.9	61.205.120.130
Nov 21, 2024 11:27:14.233436108 CET	49952	123	192.168.2.9	129.6.15.28
Nov 21, 2024 11:27:15.406920910 CET	123	49952	129.6.15.28	192.168.2.9
Nov 21, 2024 11:27:15.435117006 CET	123	49952	169.229.128.134	192.168.2.9
Nov 21, 2024 11:27:15.460308075 CET	123	49952	193.171.23.163	192.168.2.9
Nov 21, 2024 11:27:15.471101046 CET	123	49952	62.149.0.30	192.168.2.9
Nov 21, 2024 11:27:15.573987961 CET	123	49952	61.205.120.130	192.168.2.9
Nov 21, 2024 11:27:20.473581076 CET	53	62966	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:20.842323065 CET	53	49323	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:27.099360943 CET	62077	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:27.099833965 CET	61545	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:27.100174904 CET	52334	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:27.100630999 CET	53919	53	192.168.2.9	1.1.1.1
Nov 21, 2024 11:27:27.325759888 CET	53	62077	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:27.325839996 CET	53	52334	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:27.326067924 CET	53	61545	1.1.1.1	192.168.2.9
Nov 21, 2024 11:27:27.326612949 CET	53	53919	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 11:26:51.066031933 CET	192.168.2.9	1.1.1.1	0xc059	Standard query (0)	rm.anonbaba.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:26:55.007359028 CET	192.168.2.9	1.1.1.1	0xfc11	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.991122007 CET	192.168.2.9	1.1.1.1	0x67ed	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.992580891 CET	192.168.2.9	1.1.1.1	0xe294	Standard query (0)	time-a-g.nist.gov	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.992774963 CET	192.168.2.9	1.1.1.1	0x639e	Standard query (0)	ts1.aco.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.992835045 CET	192.168.2.9	1.1.1.1	0x3496	Standard query (0)	ntp.nict.jp	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.993098974 CET	192.168.2.9	1.1.1.1	0x72c8	Standard query (0)	ntp.time.in.ua	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:13.993211031 CET	192.168.2.9	1.1.1.1	0xca91	Standard query (0)	ntp1.net.berkeley.edu	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.099360943 CET	192.168.2.9	1.1.1.1	0xdeed	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.099833965 CET	192.168.2.9	1.1.1.1	0x5448	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 11:27:27.100174904 CET	192.168.2.9	1.1.1.1	0x5abb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.100630999 CET	192.168.2.9	1.1.1.1	0x4cc1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 11:26:51.315473080 CET	1.1.1.1	192.168.2.9	0xc059	No error (0)	rm.anonbaba.net		179.43.171.197	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:26:55.234137058 CET	1.1.1.1	192.168.2.9	0xfc11	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.217262983 CET	1.1.1.1	192.168.2.9	0x67ed	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219158888 CET	1.1.1.1	192.168.2.9	0xe294	No error (0)	time-a-g.nist.gov		129.6.15.28	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219232082 CET	1.1.1.1	192.168.2.9	0x72c8	No error (0)	ntp.time.in.ua		62.149.0.30	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219321966 CET	1.1.1.1	192.168.2.9	0x3496	No error (0)	ntp.nict.jp		61.205.120.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219321966 CET	1.1.1.1	192.168.2.9	0x3496	No error (0)	ntp.nict.jp		133.243.238.163	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219321966 CET	1.1.1.1	192.168.2.9	0x3496	No error (0)	ntp.nict.jp		133.243.238.244	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219321966 CET	1.1.1.1	192.168.2.9	0x3496	No error (0)	ntp.nict.jp		133.243.238.164	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.219321966 CET	1.1.1.1	192.168.2.9	0x3496	No error (0)	ntp.nict.jp		133.243.238.243	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.220230103 CET	1.1.1.1	192.168.2.9	0xca91	No error (0)	ntp1.net.berkeley.edu		169.229.128.134	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:14.232342958 CET	1.1.1.1	192.168.2.9	0x639e	No error (0)	ts1.aco.net		193.171.23.163	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.325759888 CET	1.1.1.1	192.168.2.9	0xdeed	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.325759888 CET	1.1.1.1	192.168.2.9	0xdeed	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.325839996 CET	1.1.1.1	192.168.2.9	0x5abb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.325839996 CET	1.1.1.1	192.168.2.9	0x5abb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:27:27.326067924 CET	1.1.1.1	192.168.2.9	0x5448	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 11:27:27.326612949 CET	1.1.1.1	192.168.2.9	0x4cc1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	178.237.33.50	80	6316	C:\Users\user\task.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 11:26:55.359579086 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Nov 21, 2024 11:26:56.599136114 CET	1170	IN	HTTP/1.1 200 OK date: Thu, 21 Nov 2024 10:26:56 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.75", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49740	179.43.171.196	443	1872	C:\Windows\System32\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 10:27:44 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-11-21 10:27:44 UTC	169	OUT	Data Raw: 74 d8 f6 08 2f 86 9d 90 1d 01 a1 43 00 a1 53 01 a1 42 ce 67 3e f9 9e a1 50 91 86 a1 4e d9 26 7b 45 33 42 39 32 45 41 41 2d 46 35 43 37 2d 34 37 46 38 2d 41 34 38 37 2d 46 34 36 36 46 34 32 30 33 35 41 31 7d a1 44 d9 2a 49 6e 74 65 6c 28 52 29 20 38 32 35 37 34 4c 20 47 69 67 61 62 69 74 20 4e 65 74 77 6f 72 6b 20 43 6f 6e 6e 65 63 74 69 6f 6e a1 41 ab 31 39 32 2e 31 36 38 2e 32 2e 39 a1 4b ad 32 35 35 2e 32 35 35 2e 32 35 35 2e 30 a1 4d c4 06 ec f4 bb 45 f6 9d a1 47 ab 31 39 32 2e 31 36 38 2e 32 2e 31 Data Ascii: t/CSBg>PN&{E3B92EAA-F5C7-47F8-A487-F466F42035A1}D*Intel(R) 82574L Gigabit Network ConnectionA192.168.2.9K255.255.255.0MEG192.168.2.1

Target ID:	0
Start time:	05:26:32
Start date:	21/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\wE1inOhJA5.msi"
Imagebase:	0x7ff63ebe0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	05:26:32
Start date:	21/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff63ebe0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	05:26:33
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E1280F90D0867DD413F7EEEF5D19EFB6
Imagebase:	0x6f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	05:26:34
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Imagebase:	0x910000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	05:26:34
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	05:26:34
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Imagebase:	0xbd0000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	05:26:35
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	05:26:36
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files\task.exe"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000008.00000002.1571921794.0000000002590000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	05:26:39
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	05:26:39
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	05:26:39
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 976
Imagebase:	0x160000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\files"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Imagebase:	0x7ff7fb2c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-70394d6c-f51f-472d-a6f7-915654cf9b1e\." /SETINTEGRITYLEVEL (CI)(OI)LOW
Imagebase:	0x910000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	05:26:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	05:26:50
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	"task.exe"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.4483545764.00000000000B6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.4490232230.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.4495447446.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Target ID:	24
Start time:	05:26:57
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\gifwhgt"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	05:26:57
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\task.exe
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.1668759956.0000000002D70000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000019.00000003.1674900501.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000019.00000003.1662192131.0000000000580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.1668306416.0000000002B50000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	26
Start time:	05:26:57
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\jckohyeeyyu"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	05:26:57
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\task.exe /stext "C:\Users\user\AppData\Local\Temp\tfphirpfmgmayj"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	05:26:58
Start date:	21/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\apps.bat" "
Imagebase:	0x7ff7fb2c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	05:26:58
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	05:26:58
Start date:	21/11/2024
Path:	C:\Users\user\task.exe
Wow64 process (32bit):	true
Commandline:	"task.exe"
Imagebase:	0x400000
File size:	40'376 bytes
MD5 hash:	F1B14F71252DE9AC763DBFBFBFC8C2DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001E.00000002.4482520616.0000000000060000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001E.00000002.4483930249.0000000000176000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	31
Start time:	05:26:59
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0xcb0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000003.1672134784.0000000003480000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.1677021053.0000000005430000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.1677266218.0000000005650000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000002.1765068419.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	32
Start time:	05:27:08
Start date:	21/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	05:27:17
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user\AppData\Local\Temp\chrFE01.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/6c77fc35"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	05:27:18
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2376,i,16818295695986717264,7118115118329945779,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	05:27:20
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	--user-data-dir="C:\Users\user\AppData\Local\Temp\chr6BC.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/10d9defc/32916e99"
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	05:27:21
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=2100,i,4541570122865520646,14461282582081406380,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	42
Start time:	05:27:38
Start date:	21/11/2024
Path:	C:\Program Files\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmplayer.exe"
Imagebase:	0x7ff7839a0000
File size:	171'008 bytes
MD5 hash:	89DCD2D4C0EC638AADC00D3530E07E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	43
Start time:	05:27:41
Start date:	21/11/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff733cd0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false